CVE-2026-46427: Budibase

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource config fields whose schema type is DatasourceFieldType.PASSWORD. The Snowflake integration types its privateKey field as SENSITIVE_LONGFORM, which the filter skips. GET /api/datasources/:datasourceId lives on authorizedRoutes guarded by PermissionType.TABLE + PermissionLevel.READ. An authenticated BASIC user with any app role and call the endpoint and receive the full Snowflake PEM in plaintext. This vulnerability is fixed in 3.38.3.

Affected products

• Budibase Budibase: before 3.38.3 (fixed in 3.38.3)

Published 2026-05-27. Last modified 2026-06-17.