PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54350 Budibase CVE debrief

CVE-2026-54350 is a critical vulnerability in Budibase, an open-source low-code platform. Prior to version 3.39.12, an unauthenticated visitor of any published Budibase app can read every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection. If the builder has published a PUBLIC write query, the visitor can also modify every document of that collection with one HTTP request. The vulnerability is caused by the enrichContext function at packages/server/src/sdk/workspace/queries/queries.ts:121-138, which substitutes parameter values into the raw JSON body of a query, and the validateQueryInputs function at packages/server/src/api/controllers/query/index.ts:61-71, which does not escape JSON metacharacters. This allows an attacker to lift attacker-controlled fields into the parsed filter object, potentially returning every document in the collection. The vulnerability is fixed in version 3.39.12.

Vendor
Budibase
Product
Unknown
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-30
Advisory published
2026-06-26
Advisory updated
2026-06-30

Who should care

Budibase users and administrators should be aware of this critical vulnerability and take immediate action to update to version 3.39.12 or later. Additionally, users who have published Budibase apps with PUBLIC write queries should review their apps for potential modifications. Security teams should also be aware of the potential for unauthenticated access to sensitive data.

Technical summary

The vulnerability is caused by a combination of two factors: the enrichContext function, which substitutes parameter values into the raw JSON body of a query, and the validateQueryInputs function, which does not escape JSON metacharacters. This allows an attacker to inject malicious JSON code, potentially returning every document in the collection or modifying documents without authorization. The vulnerability affects Budibase versions prior to 3.39.12 and is fixed in version 3.39.12.

Defensive priority

This vulnerability has a CVSS score of 10 and a severity of CRITICAL. Budibase users and administrators should prioritize updating to version 3.39.12 or later as soon as possible.

Recommended defensive actions

  • Update to Budibase version 3.39.12 or later
  • Review published Budibase apps for potential modifications
  • Monitor for suspicious activity
  • Implement additional security measures, such as authentication and authorization, for Budibase apps
  • Review and update security configurations for Budibase installations

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and severity. The source item URL provides additional information on the vulnerability, including references to security advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54350 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54350

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54350 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54350

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.