CVE-2026-72851: Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
Published Aug 13, 2026
·Updated
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.
Affected Software
1 affected component
budibase Budibase<3.40.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.40.0 - Compensating control
Ensure the webhook trigger endpoint used by webhook-triggered automations is authenticated/does not allow unauthenticated POSTs of attacker-controlled JSON (so EXECUTE_QUERY steps cannot be triggered without authorization).
Event History
Aug 13, 2026
CVE Published
via MITRE·09:54 PM
Data Sourced
via MITRE·09:54 PM
DescriptionSeverityWeakness