What’s Vulnerable › Products

budibase server vulnerabilities

24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.

Check whether your budibase server version is affected

Latest budibase server vulnerabilities

• CVE-2026-100688 — Budibase server before 3.45.0 Cross-Tenant Information Disclosure (CVSS 6.5)
• CVE-2026-100687 — Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast (CVSS 5.5)
• CVE-2026-100686 — Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps (CVSS 8.1)
• CVE-2026-100685 — Budibase before 3.45.0 Information Disclosure via Chat Links (CVSS 7.7)
• CVE-2026-100684 — Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC (CVSS 8.1)
• CVE-2026-100683 — Budibase before 3.45.0 SQL Injection via column-rename DDL (CVSS 8.0)
• CVE-2026-100682 — Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink (CVSS 8.8)
• CVE-2026-100681 — Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook (CVSS 5.4)
• CVE-2026-100680 — Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import (CVSS 8.1)
• CVE-2026-82246 — Budibase Server before 3.41.3 SSRF via Query Import (CVSS 7.1)
• CVE-2026-82245 — Budibase before 3.41.3 Missing Authorization License Management (CVSS 8.1)
• CVE-2026-82244 — Budibase before 3.41.3 Remote Code Execution via Plugin eval() (CVSS 9.1)
• CVE-2026-82243 — Budibase Server before 3.41.3 SSRF with Credential Leakage (CVSS 7.6)
• CVE-2026-82242 — Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization (CVSS 7.7)
• CVE-2026-82241 — Budibase backend-core SSRF via incomplete default blacklist (CVSS 7.1)
• CVE-2026-82240 — Budibase before 3.41.3 Privilege Escalation via User Update API (CVSS 8.1)
• CVE-2026-82239 — Budibase before 3.41.3 Authorization Bypass via datasources/query (CVSS 8.1)
• CVE-2026-72859 — Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL (CVSS 7.7)
• CVE-2026-72855 — Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST (CVSS 8.5)
• CVE-2026-72851 — Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook (CVSS 10.0)
• CVE-2026-72850 — Budibase before 3.40.0 Arbitrary File Write via Path Traversal (CVSS 9.1)
• CVE-2026-72849 — Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF (CVSS 7.7)
• CVE-2026-73618 — Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter (CVSS 8.3)
• CVE-2026-73617 — Budibase before 3.40.0 NoSQL Injection via MongoDB datasource (CVSS 7.1)