CVE-2026-72853: Budibase before 3.40.0 SQL Injection via Oracle connector
Published Aug 13, 2026
·Updated
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.
Affected Software
1 affected component
budibase Budibase<3.40.0
Event History
Aug 13, 2026
CVE Published
via MITRE·09:54 PM
Data Sourced
via MITRE·09:54 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-72853?
The severity of CVE-2026-72853 is high with a score of 7.6.
2
What type of vulnerability is identified in CVE-2026-72853?
CVE-2026-72853 is classified as a SQL Injection vulnerability.
3
How can I mitigate the risk associated with CVE-2026-72853?
To mitigate CVE-2026-72853, upgrade Budibase to version 3.40.0 or later.
4
Which component of Budibase is affected by CVE-2026-72853?
CVE-2026-72853 affects the Oracle datasource connector in Budibase.
5
What conditions must be met for CVE-2026-72853 to be exploited?
An attacker must have write permission on a table with a double-quote in its name to exploit CVE-2026-72853.