CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase Unauthenticated NoSQL Operator Injection Unauthenticated JSON/NoSQL operator injection in Budibase. Any anonymous visitor of a published Budibase app that exposes a PUBLIC query backed by a document datasource MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST wi...

Budibase - Authentication Bypass

Budibase = 3.31.4 contains an authentication bypass caused by unanchored regex in authorized middleware matching webhook path patterns in query strings, letting unauthenticated remote attackers access any server-side API endpoint, exploit requires crafted request with webhook pattern in URL. id:...

CVE-2026-31816

CVE-2026-31816 - Budibase 认证绕过至远程代码执行（RCE） CVE-2026-31816 是一个影响 Budibase 的严重认证与授权绕过漏洞。 该漏洞存在于负责保护 API 端点的服务端授权中间件中。Budibase 尝试使用一个未锚定的正则表达式来识别合法的 Webhook 端点，并将该表达式作用于 Koa 的 ctx.request.url。 由于 ctx.request.url 包含查询字符串，攻击者可以将一个看起来像 Webhook 的路径注入到原本无关的 API 请求的查询组件中。 例如： root@kitploit:...

CVE-2026-54356

CVE-2026-54356 — Budibase：经认证的任意 S3 签名上传 URL 签发 已发布 Budibase 工作区中低权限（BASIC 角色）的已认证用户可以调用 POST /api/attachments/:datasourceId/url，并获得一个使用工作区数据源的服务端 AWS 凭据 签名的 S3 预签名上传 URL ，适用于攻击者控制的对象键（并且，如果数据源没有固定存储桶，也可以是攻击者控制的存储桶）。 | ---|--- CVE| CVE-2026-54356 公告| GHSA-6x9p-4r67-5gjx 软件包| @budibase/server 类型|...

CVE-2026-31816-rshell

CVE-2026-31816 反向 Shell 漏洞利用工具 概述 该工具利用 CVE-2026-31816 在目标 Budibase 服务器上建立反向 Shell 连接。 攻击链 ：身份验证绕过 → 上传 DATASOURCE 插件 → 服务端代码执行 → 反向 Shell 环境要求 Python 3.6+ requests 库（pip install requests） 存在 CVE-2026-31816 漏洞的目标 Budibase 服务器 使用方法 基本步骤 root@kitploit: 1. 在攻击机启动监听器 nc -lvnp 4444 2. 运行漏洞利用工具（另一个终端）...

CVE-2026-82246

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

CVE-2026-82245

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...

CVE-2026-82244

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...

CVE-2026-82240

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82243

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82241

Budibase backend-core @budibase/backend-core, as used by @budibase/server omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist DEFAULTBLACKLIST used by REST datasource query previews. When the default blacklist is active i.e., a self-hosted deployment has not defined...

CVE-2026-82242

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace...

CVE-2026-82239

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...

EUVD-2026-67697

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...

CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...

CVE-2026-82245

Budibase before 3.41.3 fails to enforce role-based authorization on its license management endpoints (/api/global/license/*), allowing any authenticated user with basic privileges to delete license keys or manipulate offline tokens. An attacker can thereby disable premium features and downgrade t...

CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

EUVD-2026-67698

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...

CVE-2026-82246

Budibase Server before 3.41.3 is affected by a server-side request forgery (SSRF) vulnerability in the query import endpoint . The root cause is the failure to validate user-supplied URLs before fetching content, allowing authenticated attackers to submit arbitrary URLs and retrieve responses fro...