CVE-2026-72851: Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.40.0 - Compensating control
Ensure the webhook trigger endpoint used by webhook-triggered automations is authenticated/does not allow unauthenticated POSTs of attacker-controlled JSON (so EXECUTE_QUERY steps cannot be triggered without authorization).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72851?
CVE-2026-72851 has a critical severity rating of 10.
How do I fix CVE-2026-72851?
To fix CVE-2026-72851, upgrade Budibase to version 3.40.0 or later.
What type of vulnerability is CVE-2026-72851?
CVE-2026-72851 is a SQL Injection vulnerability.
Can attackers exploit CVE-2026-72851 without authentication?
Yes, attackers can exploit CVE-2026-72851 without authentication via webhook-triggered automations.
What can attackers achieve by exploiting CVE-2026-72851?
By exploiting CVE-2026-72851, attackers can execute arbitrary SQL commands using the application’s database credentials.