CVE-2026-73617: Budibase before 3.40.0 NoSQL Injection via MongoDB datasource
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.40.0 - Compensating control
Ensure MongoDB datasource query parameters are not enriched/parsed without operator filtering (the vulnerability is described as parsing user-supplied parameters after handlebars enrichment with noEscaping: true and no operator filtering).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73617?
The severity of CVE-2026-73617 is rated high with a score of 7.1.
How do I fix CVE-2026-73617?
To fix CVE-2026-73617, upgrade Budibase to version 3.40.0 or later.
What type of vulnerability is CVE-2026-73617?
CVE-2026-73617 is a NoSQL injection vulnerability affecting Budibase's MongoDB datasource.
What are the consequences of exploiting CVE-2026-73617?
Exploiting CVE-2026-73617 allows attackers to execute unauthorized MongoDB commands by injecting operators through query parameters.
Which software is affected by CVE-2026-73617?
CVE-2026-73617 affects Budibase versions prior to 3.40.0.