CVE-2026-72857 in Budibase
Summary
by MITRE • 08/14/2026
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability represents a critical information disclosure flaw in Budibase versions prior to 3.40.0 where the application fails to properly redact sensitive credentials stored within STRING typed fields of datasource configurations. The technical implementation defect stems from inadequate input sanitization and output filtering mechanisms that do not distinguish between regular string data and credential information when rendering datasource settings through the application's read API endpoints. This vulnerability specifically affects database connection strings used for MongoDB integrations and Firebase private keys that are stored in plaintext within the application's configuration management system.
The operational impact of this vulnerability is severe as it provides authenticated attackers with direct access to production backend credentials without requiring additional exploitation techniques. Attackers with merely table read permissions can leverage the exposed API endpoints to enumerate datasource configurations and extract complete connection strings containing database hostnames, ports, authentication credentials, and other sensitive parameters. Similarly, Firebase private keys retrieved in plaintext provide attackers with unauthorized access to cloud resources and services that rely on these service account credentials for authentication and authorization.
From a cybersecurity perspective, this vulnerability maps directly to CWE-200 Information Exposure and CWE-522 Insufficiently Protected Credentials, representing a failure in proper credential handling and sensitive data protection mechanisms. The attack vector aligns with ATT&CK technique T1552.001 for Unsecured Credentials and T1071.004 for Application Layer Protocol DNS, as attackers can potentially use the extracted credentials to establish unauthorized connections to backend systems and exfiltrate data through established protocols. The vulnerability essentially eliminates the need for complex attack chains since the credentials are directly exposed through legitimate API access paths.
Organizations using affected versions of Budibase should immediately implement mitigations including updating to version 3.40.0 or later where proper credential redaction has been implemented, implementing additional access controls to limit read permissions on datasource configurations, and conducting thorough audits of all stored credentials to ensure timely revocation and replacement of compromised keys. Network monitoring should be enhanced to detect unusual API access patterns that might indicate credential harvesting attempts, while application-level logging should capture all datasource configuration access events for forensic analysis. Additionally, implementing principle of least privilege access controls and regular security assessments of configuration management systems will help prevent similar vulnerabilities from occurring in other applications within the organization's attack surface.