CVE-2026-72857: Budibase before 3.40.0 Credential Exposure via STRING Fields
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.40.0 - Compensating control
Ensure only trusted/authorized users have 'table read' permissions, since users with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72857?
The severity of CVE-2026-72857 is rated high with a score of 7.7.
How do I fix CVE-2026-72857?
To fix CVE-2026-72857, upgrade Budibase to version 3.40.0 or later.
What type of exposure is associated with CVE-2026-72857?
CVE-2026-72857 involves credential exposure as it allows authenticated users to access sensitive datasource credentials.
In which versions of Budibase is CVE-2026-72857 present?
CVE-2026-72857 is present in Budibase versions prior to 3.40.0.
Who is affected by CVE-2026-72857?
Authenticated users with table read permissions in Budibase before version 3.40.0 are affected by CVE-2026-72857.