CVE-2026-72851 in Budibase
Summary
by MITRE • 08/14/2026
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within Budibase's automation framework where webhook-triggered workflows can execute database queries through EXECUTE_QUERY steps without proper authentication verification. The flaw allows remote attackers to submit malicious JSON payloads via unauthenticated POST requests to webhook endpoints, directly manipulating the database query execution process. The technical implementation relies on insufficient input validation and sanitization of user-supplied data within the automation engine, creating a path for arbitrary SQL command injection attacks. When such payloads are processed, they execute with the privileges of database credentials configured by system builders, potentially exposing sensitive data or enabling unauthorized modifications to connected data sources including Snowflake environments.
The operational impact of this vulnerability spans multiple security domains and can result in complete compromise of connected databases. Attackers can leverage this weakness to extract confidential information from database tables, modify or delete critical data, and establish persistent access through crafted SQL commands that may create backdoor accounts or alter system configurations. The vulnerability particularly affects organizations using Budibase for business intelligence or operational workflows where sensitive data resides in connected data warehouses like Snowflake. This represents a critical risk as the attack surface includes any webhook endpoint configured to trigger database operations without proper authentication checks, making it exploitable across various automation scenarios.
Security controls should focus on implementing robust input validation and sanitization mechanisms at all entry points where user-supplied data is processed within automation workflows. Organizations must enforce authentication requirements for all webhook endpoints that trigger database operations, ensuring that only authorized systems can initiate such processes. The implementation of parameterized queries and prepared statements should be mandatory for any database interaction within automation steps to prevent SQL injection exploitation. Additionally, network segmentation and access controls should limit exposure of webhook endpoints, while monitoring solutions should be deployed to detect anomalous query patterns or unauthorized access attempts to database resources. This vulnerability aligns with CWE-89 (SQL Injection) and maps to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) in scenarios where attackers might use DNS tunneling to exfiltrate data from compromised databases.
The remediation approach requires immediate patching of Budibase installations to version 3.40.0 or later, which addresses the authentication bypass and input validation issues within webhook processing. System administrators should conduct comprehensive audits of all webhook endpoints configured for database operations, ensuring proper access controls are implemented and that only trusted sources can trigger automation workflows. Database connection credentials should be reviewed and restricted to minimum required privileges, implementing principle of least privilege access models. Regular security assessments should include testing for similar injection vulnerabilities in other automation components, as the architectural pattern may exist in related systems. Organizations utilizing automated database operations must establish secure coding practices that enforce strict input validation and prevent dynamic query construction from user-supplied values, thereby reducing attack surface exposure across their entire application ecosystem.