CVE-2026-35216 in Budibase
Summary
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Responsible
GitHub_M
Reservation
04/01/2026
Disclosure
04/03/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 355174 | Budibase Public Webhook Endpoint os command injection | 78 | Not defined | Official fix | CVE-2026-35216 |