CVE-2026-73407

Budibase CVE-2026-73407: Unauthenticated REST datasource credential theft via cross-origin auth leak in RestIntegration._req (packages/server/src/integrations/rest.ts) prior to 3.40.1. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId could supply an absolute or parameterized pa...