CVE-2026-72853: Budibase before 3.40.0 SQL Injection via Oracle connector

Q: What is the severity of CVE-2026-72853?

The severity of CVE-2026-72853 is high with a score of 7.6.

Q: What type of vulnerability is identified in CVE-2026-72853?

CVE-2026-72853 is classified as a SQL Injection vulnerability.

Q: How can I mitigate the risk associated with CVE-2026-72853?

To mitigate CVE-2026-72853, upgrade Budibase to version 3.40.0 or later.

Q: Which component of Budibase is affected by CVE-2026-72853?

CVE-2026-72853 affects the Oracle datasource connector in Budibase.

Q: What conditions must be met for CVE-2026-72853 to be exploited?

An attacker must have write permission on a table with a double-quote in its name to exploit CVE-2026-72853.

Published Aug 13, 2026

Updated

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.

Affected Software

1 affected component

budibase Budibase<3.40.0

Event History

Aug 13, 2026

CVE Published

via MITRE·09:54 PM

Data Sourced

via MITRE·09:54 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72853?

The severity of CVE-2026-72853 is high with a score of 7.6.

What type of vulnerability is identified in CVE-2026-72853?

CVE-2026-72853 is classified as a SQL Injection vulnerability.

How can I mitigate the risk associated with CVE-2026-72853?

To mitigate CVE-2026-72853, upgrade Budibase to version 3.40.0 or later.

Which component of Budibase is affected by CVE-2026-72853?

CVE-2026-72853 affects the Oracle datasource connector in Budibase.

What conditions must be met for CVE-2026-72853 to be exploited?

An attacker must have write permission on a table with a double-quote in its name to exploit CVE-2026-72853.

CVE-2026-72853: Budibase before 3.40.0 SQL Injection via Oracle connector

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-72853?

What type of vulnerability is identified in CVE-2026-72853?

How can I mitigate the risk associated with CVE-2026-72853?

Which component of Budibase is affected by CVE-2026-72853?

What conditions must be met for CVE-2026-72853 to be exploited?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-72853?

What type of vulnerability is identified in CVE-2026-72853?

How can I mitigate the risk associated with CVE-2026-72853?

Which component of Budibase is affected by CVE-2026-72853?

What conditions must be met for CVE-2026-72853 to be exploited?