CVE-2026-100680 budibase CVE debrief

Who should care

Budibase server administrators, developers, and security teams should assess exposure and prioritize upgrading to version 3.45.0 or later. Restricting OpenAPI import access and monitoring for suspicious activity are also recommended.

Why it matters

CVE-2026-100680 is a high-severity vulnerability in Budibase server versions before 3.45.0, allowing authenticated builders to read arbitrary local files via OpenAPI import. Defenders should prioritize upgrading to version 3.45.0 or later, restricting OpenAPI import access, and monitoring for suspicious activity. The vulnerability's impact is supported by the CVE record and source item, but actual exploitation and victim organizations are not reported.

• Potential exfiltration of sensitive files, including environment variables with JWT secrets, API keys, and database credentials.
• Possible disruption of service due to unauthorized access to sensitive files.
• Need for verification of affected versions and exposure in specific deployment contexts.
• Priority for upgrading to version 3.45.0 or later and restricting OpenAPI import access.

Technical summary

Budibase server versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator. This allows authenticated builders to read arbitrary local files by embedding file:// references in OpenAPI specifications submitted to the import endpoint. The vulnerability is caused by the lack of proper validation and sanitization of user-input data, which enables attackers to access sensitive files and data. The CVE record and source item provide details on the vulnerability, including affected versions and potential impacts.

Defensive priority

High priority for Budibase server administrators to upgrade to version 3.45.0 or later and restrict OpenAPI import access.

Recommended defensive actions

• Upgrade Budibase server to version 3.45.0 or later
• Restrict access to OpenAPI import functionality
• Monitor for suspicious activity related to OpenAPI imports
• Review and update environment variables and sensitive files
• Perform a thorough review of the system for any signs of exploitation
• Implement additional monitoring and logging to detect potential attacks
• Conduct a comprehensive risk assessment to identify potential vulnerabilities

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and potential impacts. However, limited information is available on actual exploitation or victim organizations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.