CVE-2026-72851Unauthenticated SQL Injection in Budibase
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.
View on NVDAnalysis
Budibase presenta una vulnerabilidad de inyección SQL sin autenticación en las automatizaciones activadas por webhooks. Los atacantes pueden enviar peticiones JSON para ejecutar comandos SQL arbitrarios en bases de datos conectadas, permitiendo la exfiltración o modificación total de los datos. Se recomienda actualizar inmediatamente a la versión 3.40.0 para proteger la integridad de sus fuentes de datos.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCWE-89EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.