CVE-2026-72851: Budibase Server

Critical severity, CVSS 10.0. EPSS: 0.4% chance of exploitation in the next 30 days.

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

Affected products

• Budibase Server: before 3.40.0 (fixed in 3.40.0)

Published 2026-08-13. Last modified 2026-10-08.