CVE-2026-35216 Budibase CVE debrief

Who should care

Budibase users and administrators, platform operators, security teams, and vulnerability management teams should be aware of this critical vulnerability and take immediate action to patch their installations. The vulnerability allows for unauthenticated Remote Code Execution (RCE) on the Budibase server, which can lead to a complete compromise of the system.

Technical summary

The vulnerability exists in the Budibase platform, specifically in the automation feature that allows for Bash steps. An unauthenticated attacker can exploit this vulnerability by triggering an automation via the public webhook endpoint, leading to Remote Code Execution (RCE) on the server. The process executes with root privileges inside the container, making it a critical vulnerability. The issue has been patched in version 3.33.4. Budibase users should assess their exposure and apply the patch.

Defensive priority

Highest Priority for Budibase users and administrators due to unauthenticated RCE risk. Immediate patching is recommended, followed by review of automation configurations and monitoring for suspicious activity on the Budibase server. Additional security measures should be implemented to prevent exploitation, such as restricting access to the public webhook endpoint and implementing compensating controls for exposed systems while remediation is scheduled and verified. Tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented are also crucial steps to ensure the vulnerability is properly addressed and mitigated against future attacks. Monitoring relevant logs and detection systems for exposed assets that need extra review is essential for minimizing potential damage from this vulnerability. Asset inventory management should also be reviewed to ensure all affected systems are accounted for and prioritized for remediation based on their criticality and potential impact on the organization if exploited. Rolling back change windows and implementing source tracking can further enhance the defensive posture against this and similar vulnerabilities in the future. Therefore, the defensive priority is not just high but demands immediate and comprehensive defensive actions across multiple fronts to safeguard against potential exploitation and minimize organizational risk effectively. Given the severity and potential impact, assigning an owner for follow-up on affected product deployments in managed environments is critical for ensuring timely and effective remediation. Reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance is also essential for accurate risk assessment and planning of appropriate mitigations through normal change control processes where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified to minimize potential damage. Checking relevant monitoring, detection, and logs for exposed assets that need extra review is crucial for early detection of potential exploitation attempts. In the

Recommended defensive actions

• Apply the patch by upgrading to Budibase version 3.33.4 or later
• Restrict access to the public webhook endpoint
• Monitor for suspicious activity on the Budibase server
• Implement additional security measures to prevent exploitation
• Review automation configurations for potential vulnerabilities
• Verify patch application and test for exploitation attempts
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-04-03T16:16:41.800Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS score of 9 and a severity of CRITICAL. Evidence is limited, and defenders should verify Budibase usage and automation configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.