CVE-2026-46427: Budibase: Snowflake private key returned unmasked from datasource API to BASIC users
Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource config fields whose schema type is DatasourceFieldType.PASSWORD. The Snowflake integration types its privateKey field as SENSITIVELONGFORM, which the filter skips. GET /api/datasources/:datasourceId lives on authorizedRoutes guarded by PermissionType.TABLE + PermissionLevel.READ. An authenticated BASIC user with any app role and call the endpoint and receive the full Snowflake PEM in plaintext. This vulnerability is fixed in 3.38.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46427?
The severity of CVE-2026-46427 is high with a score of 7.7.
What does CVE-2026-46427 affect?
CVE-2026-46427 affects Budibase versions prior to 3.38.3 and involves the exposure of a Snowflake private key to BASIC users.
How do I fix CVE-2026-46427?
To fix CVE-2026-46427, upgrade Budibase to version 3.38.3 or later.
What kind of vulnerability is CVE-2026-46427 categorized as?
CVE-2026-46427 is categorized as an information leak vulnerability.
What is the impact of CVE-2026-46427?
The impact of CVE-2026-46427 includes unauthorized access to sensitive data due to unmasked private keys in the datasource API.