CVE-2026-41428: Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41428?
CVE-2026-41428 has a critical severity level due to its potential for unauthenticated access to protected endpoints.
How do I fix CVE-2026-41428?
To fix CVE-2026-41428, update Budibase to version 3.35.4 or later, which addresses the unanchored regex issue in the authentication middleware.
What type of vulnerability is CVE-2026-41428?
CVE-2026-41428 is an authentication bypass vulnerability that allows unauthorized access to otherwise protected resources.
Which versions of Budibase are affected by CVE-2026-41428?
Budibase versions prior to 3.35.4 are affected by CVE-2026-41428.
What can an attacker achieve with CVE-2026-41428?
An attacker can exploit CVE-2026-41428 to gain unauthorized access to protected endpoints without needing authentication.