LiveActive security incident?Get immediate response
CVE Record

CVE-2026-72851: Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Budibase versions before 3.40.0 can allow an unauthenticated attacker to manipulate connected databases through certain webhook automations. Successful abuse could expose or alter data and establish persistence using the database privileges configured by the application. Risk is highest where vulnerable webhook endpoints are reachable and automations contain EXECUTE_QUERY steps.

Executive priority

Prioritize immediate remediation where vulnerable Budibase deployments expose qualifying webhooks to untrusted users or connect with powerful database credentials. Upgrade promptly, reduce endpoint reachability, and investigate recent webhook and database activity. Lower-access internal instances still require timely review because exploitation needs no Budibase authentication.

Technical view

CVE-2026-72851 is a CWE-89 SQL injection in webhook-triggered Budibase automations containing EXECUTE_QUERY steps. Attacker-controlled JSON submitted to the unauthenticated webhook endpoint may reach database queries and execute under builder-configured credentials. The CVSS 3.1 score is 10.0, reflecting remote, low-complexity, unauthenticated impact across confidentiality, integrity, and availability.

Likely exposure

Exposure requires Budibase before 3.40.0, a webhook-triggered automation using EXECUTE_QUERY, and a connected datasource. Internet or otherwise untrusted access to the webhook endpoint increases likelihood. Actual impact depends on the privileges of the configured database credentials; the supplied sources specifically identify connected datasources such as Snowflake.

Exploitation context

The vulnerability is remotely reachable without authentication or user interaction according to the supplied CVSS vector. However, it is not listed as KEV in the source bundle, and the provided evidence does not establish active exploitation in the wild. Treat exploit availability and observed campaigns as unconfirmed.

Researcher notes

The vulnerable data flow is attacker-controlled webhook JSON reaching EXECUTE_QUERY automation steps. Database-side consequences inherit the configured credential’s authority. Scope is changed in the supplied CVSS vector. The evidence supports severe potential impact but does not confirm every pre-3.40.0 installation is exploitable; the qualifying automation configuration must exist.

Mitigation direction

  • Upgrade affected Budibase deployments to version 3.40.0 or later.
  • Identify and restrict access to webhook automations containing EXECUTE_QUERY steps.
  • Review and minimize database privileges assigned to Budibase-connected credentials.
  • Rotate connected database credentials if compromise is suspected.
  • Check the vendor advisory for any additional remediation guidance.

Validation and detection

  • Inventory Budibase versions and flag every deployment older than 3.40.0.
  • Enumerate webhook-triggered automations and identify those containing EXECUTE_QUERY steps.
  • Confirm whether affected webhook endpoints are reachable from untrusted networks.
  • Review webhook request logs for unusual unauthenticated POST activity.
  • Examine connected database audit logs for unexpected queries, changes, exports, or persistence.
  • Verify upgraded deployments report version 3.40.0 or later.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-89: Database access and collection lookup

Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-72851 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96VulnCheck
9CVSS 4.0CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

9Critical
CVSS 4.0 vector shape for CVE-2026-72851Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
budibaseserver0, 3.40.0unaffected
Weakness

CWE details

CWE-89

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.