CVE-2026-72851: Budibase SQL Injection via Unauthenticated Webhook (before 3.40.0)
Budibase versions before 3.40.0 contain an unauthenticated SQL injection flaw in webhook-triggered automations that use EXECUTE_QUERY steps, as reported by VulnCheck. The record lists a critical severity with a base score of 10, and no confirmed exploitation appears in the sources consulted. Because the affected range ends at 3.40.0, upgrading to that version or later and reviewing webhook-driven automations and connected datasources is the prudent defensive path.
Overview
CVE-2026-72851 describes an unauthenticated SQL injection issue in Budibase before 3.40.0. The flaw affects automations that are triggered by a webhook and contain EXECUTE_QUERY steps. The weakness is classified as CWE-89 (SQL Injection), as recorded by the CNA VulnCheck.
Impact
The description states that injected SQL runs with the database credentials configured by the builder. Reported consequences include data exfiltration, data modification and persistence in connected datasources such as Snowflake. The record gives a base score of 10 and lists high confidentiality, integrity and availability impact in the vendor-supplied vector.
Affected products and versions
- Budibase Server before 3.40.0
- The record does not list a separate fixed-version entry; the affected range boundary is 3.40.0.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation can be stated from the sources consulted. The SSVC field in the record indicates a proof-of-concept exploitation level and that the issue is automatable, which is a risk signal rather than evidence of attacks in the wild. The EPSS probability in the record is low.
Remediation and mitigation
- Plan an upgrade of Budibase to version 3.40.0 or later, checking the vendor advisory for the authoritative fixed release.
- Until patched, restrict exposure of webhook trigger endpoints that feed EXECUTE_QUERY steps, for example through network controls and authentication layers placed in front of the service.
- Review the database credentials used by automations and apply least privilege, limiting read and write scope to what each automation needs.
- Audit connected datasources, such as Snowflake, for unexpected changes or access patterns.
Detection guidance
- Review web server and application logs for unusual requests to webhook trigger endpoints, especially unauthenticated requests with unexpected body content.
- Monitor database audit logs for queries originating from Budibase service accounts that differ from normal automation behavior.
- Alert on schema changes or bulk data reads performed through automation service credentials.
Limitations of the available information
The record does not list a fixed version explicitly, so the patched release is inferred from the affected range. The record has a source status of Deferred and the CVSS details are supplied by the CNA and an additional provider. No vendor fix note was included in the record. Details of the vulnerable code path, required trigger conditions and specific affected configurations are not available in the record.
Frequently asked questions
What is CVE-2026-72851?
It is an unauthenticated SQL injection vulnerability in Budibase before 3.40.0, affecting webhook-triggered automations that include EXECUTE_QUERY steps.
Is this vulnerability known to be actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted.
What should administrators do now?
Plan an upgrade to Budibase 3.40.0 or later, restrict exposure of webhook endpoints, apply least privilege to automation database credentials, and review logs and connected datasources.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.