High severity8.1NVD Advisory· Published Sep 26, 2026· Updated Oct 8, 2026
CVE-2026-100680
CVE-2026-100680
Description
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- Budibase: Nine Vulnerabilities Including Auth Bypass and File Write Disclosed TogetherVypr Intelligence · Sep 26, 2026