CVE-2026-64657: Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibase (PostgreSQL datasource connector)to a version that resolves this vulnerability.Fixed in 3.39.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64657?
CVE-2026-64657 has a high severity rating of 8.4.
What types of databases are affected by CVE-2026-64657?
CVE-2026-64657 affects PostgreSQL, MS SQL, and MySQL databases used with Budibase.
How do I fix CVE-2026-64657?
To fix CVE-2026-64657, upgrade Budibase to version 3.39.19 or later.
What is the cause of CVE-2026-64657?
CVE-2026-64657 is caused by SQL Injection vulnerabilities in the PostgreSQL datasource connector due to improper handling of user-controlled schema configurations.
What are the potential impacts of CVE-2026-64657?
CVE-2026-64657 can lead to unauthorized access and manipulation of database information due to SQL injection attacks.