CVE-2026-100683 budibase CVE debrief

Who should care

Budibase server administrators and users with DDL rights on connected MySQL or MSSQL datasources should assess their exposure and prioritize updating to version 3.45.0 or later, considering potential impacts on database permissions, integrity, and user permissions.

Why it matters

Budibase server versions before 3.45.0 are vulnerable to SQL injection attacks via column-rename DDL operations, potentially allowing for exploitation of database permissions and arbitrary reads, writes, or destructive operations.

• Potential for arbitrary database reads and writes
• Possible exploitation of database permissions
• Risk of destructive operations on connected databases
• Need for verification of database integrity and user permissions

Technical summary

The Budibase server is vulnerable to SQL injection attacks via column-rename DDL operations. The vulnerability exists in versions before 3.45.0 and is caused by the direct interpolation of identifiers into raw query strings without proper quoting. An attacker with DDL rights on a connected MySQL or MSSQL datasource can inject malicious SQL, potentially leading to arbitrary reads, writes, or destructive operations on the connected database.

Defensive priority

High priority should be given to updating Budibase server to version 3.45.0 or later, as the vulnerability allows for potential exploitation of database permissions.

Recommended defensive actions

• Update Budibase server to version 3.45.0 or later
• Review database permissions and restrict DDL rights where possible
• Monitor database activity for suspicious queries
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and the fixed version. However, there is limited information on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.