CVE-2026-100680 in Budibase
Zusammenfassung
von MITRE • 26.09.2026
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.
If you want to get best quality of vulnerability data, you may have to visit VulDB.