A critical SQL injection flaw in Budibase before 3.40.0 lets unauthenticated attackers push arbitrary SQL into connected databases by POSTing crafted JSON to a webhook trigger endpoint.
What Is It
CVE-2026-72851 is an unauthenticated SQL injection vulnerability (CWE-89) in Budibase, the open-source low-code platform. The flaw sits in webhook-triggered automations that include EXECUTE_QUERY steps. An attacker who can reach the webhook trigger endpoint can POST attacker-controlled JSON, and that input flows into the query step without adequate handling; injecting SQL that runs against the backing datasource.
Critically, the injected SQL executes with the builder-configured database credentials, not the attacker's. Whatever access the app builder granted the automation becomes the attacker's access.
Why It Matters
The CVSS v3.1 base score is 10.0; the maximum. The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) means network-reachable, low complexity, no privileges, no user interaction, with a scope change and high confidentiality, integrity, and availability impact. The scope change is the key detail: the vulnerable component is Budibase, but the damage lands on the connected datasource behind it.
Per the advisory, the practical outcomes are data exfiltration, data modification, and persistence in connected datasources such as Snowflake. Assigner VulnCheck also supplied a CVSS v4.0 score of 9.0 (CRITICAL), which weighs the attack requirements more conservatively; a Budibase deployment must actually have a webhook-triggered automation wired to an EXECUTE_QUERY step for the bug to be reachable.
The CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed at this time. The NVD record for CVE-2026-72851 was published 2026-08-13 and, as of this writing, remains in Received status; meaning NVD has ingested the CNA submission but has not completed its own analysis.
What's Vulnerable
- Package:
pkg:npm/budibase/server(vendor: budibase, product: server) - Affected: all versions before 3.40.0
- Fixed: 3.40.0 and later
Consistent with that Received status, the NVD record carries no CPE match data yet, so automated scanners keying off CPE configurations may not flag affected installs. Match against the npm package identifier instead.
Patch Status
Upgrade Budibase server to 3.40.0 or later, which the vendor record marks unaffected. No mitigations, workarounds, or required-action deadlines are specified in the supplied source material. Operators who cannot patch immediately should note that exposure depends on having webhook-triggered automations with EXECUTE_QUERY steps.
Sources
- Budibase GitHub Security Advisory (GHSA-x7h8-ww3q-xv7c), https://github.com/Budibase/budibase/security/advisories/GHSA-x7h8-ww3q-xv7c
- VulnCheck Advisory; https://www.vulncheck.com/advisories/budibase-before-sql-injection-via-unauthenticated-webhook
- NVD record for CVE-2026-72851 (publication date, status, CPE configurations), https://nvd.nist.gov/vuln/detail/CVE-2026-72851
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog