CVE-2026-100687 in Server
Summary
by MITRE • 09/26/2026
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Budibase Server versions prior to 3.45.0 represents a critical failure in data sanitization within the real-time collaboration infrastructure of the application platform. This flaw specifically affects the mechanism used to synchronize state changes across multiple users working on the same project via WebSocket connections. When an administrator or user with Builder access performs actions such as saving or deleting external table configurations, the server broadcasts these updates to all connected clients in the builder room. However, the payload transmitted during this broadcast contains the full configuration object for the datasource, including sensitive authentication credentials like database passwords and API keys, which are not redacted before transmission. This behavior violates fundamental security principles regarding the handling of secrets within application logs and network traffic, exposing highly privileged information to any participant in the collaboration session.
From a technical perspective, this issue stems from an improper implementation of data masking or serialization logic during the WebSocket message construction process. In secure software design, sensitive fields such as passwords, tokens, and keys should be either excluded entirely from broadcast payloads or replaced with masked placeholders like asterisks before being sent over the network. The failure to perform these redactions means that any client connected to the builder websocket room can intercept these messages using standard browser developer tools or packet capture utilities if the connection is not properly secured via TLS, although even in secure connections, malicious insiders within the same workspace can easily extract this data from the application memory and event stream. This creates a direct path for credential theft without requiring any external network attack vector beyond having legitimate access to the Budibase builder interface.
The operational impact of this vulnerability is severe due to the high privilege level typically associated with Builder users in low-code platforms like Budibase. These users often have permissions to connect to production databases, integrate with sensitive third-party APIs, and manage application logic that relies on these credentials for authentication. An attacker who gains access to a builder account can harvest these plaintext secrets and use them to directly authenticate against the underlying database or external services. This could lead to unauthorized data exfiltration, modification of critical business records, or further lateral movement within an organization's infrastructure if those same credentials are reused elsewhere. The risk is amplified in team environments where multiple developers share a workspace, as any member can potentially view and steal the secrets configured by others, undermining trust and security boundaries between different teams or projects hosted on the same instance.
This vulnerability aligns with CWE-259, which describes the use of passwords or keys without proper redaction, and is closely related to CWE-798, involving the use of hardcoded credentials that are exposed through improper access controls. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates Credential Access techniques like Steal Application Credentials (T1552) by allowing attackers to harvest secrets from application data stores or memory during normal operational activities. It also touches upon Improper Privilege Management if the builder role is granted more access than necessary for collaborative editing of UI components rather than infrastructure configuration.
To mitigate this risk, organizations running Budibase versions earlier than 3.45.0 must upgrade to version 3.45.0 or later immediately, as these newer releases implement proper redaction logic for sensitive fields in websocket broadcasts. Until the upgrade is performed, administrators should restrict builder access strictly to trusted personnel and consider rotating any database passwords or API keys that may have been exposed through this channel during active usage periods. Additionally, implementing strict network segmentation and ensuring all WebSocket connections are encrypted via TLS can reduce the risk of external interception, though it does not mitigate insider threats within the application layer. Regular auditing of user permissions and minimizing the number of users with builder-level access to only those who absolutely require infrastructure configuration rights will further reduce the attack surface for this type of credential leakage.