CVE-2026-35216 in Budibase
Zusammenfassung (Englisch)
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Zuständig
GitHub_M
Reservieren
01.04.2026
Veröffentlichung
03.04.2026
Status
Bestätigt
Einträge
VulDB provides additional information and datapoints for this CVE:
| ID | Schwachstelle | CWE | Aus | Mas | CVE |
|---|---|---|---|---|---|
| 355174 | Budibase Public Webhook erweiterte Rechte | 78 | Nicht definiert | Offizieller Fix | CVE-2026-35216 |