PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54350 Budibase CVE debrief

CVE-2026-54350 is a critical vulnerability in Budibase, an open-source low-code platform. Prior to version 3.39.12, an unauthenticated visitor of any published Budibase app can read every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection. If the builder has published a PUBLIC write query, the visitor can also modify every document of that collection with one HTTP request. The vulnerability is caused by the enrichContext function at packages/server/src/sdk/workspace/queries/queries.ts:121-138, which substitutes parameter values into the raw JSON body of a query, and the validateQueryInputs function at packages/server/src/api/controllers/query/index.ts:61-71, which does not escape JSON metacharacters. This allows an attacker to lift attacker-controlled fields into the parsed filter object, potentially returning every document in the collection. The vulnerability is fixed in version 3.39.12.

Vendor
Budibase
Product
Unknown
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Budibase users and administrators should be aware of this critical vulnerability and take immediate action to update to version 3.39.12 or later. Additionally, users who have published Budibase apps with PUBLIC write queries should review their apps for potential modifications. Security teams should also be aware of the potential for unauthenticated access to sensitive data.

Technical summary

The vulnerability is caused by a combination of two factors: the enrichContext function, which substitutes parameter values into the raw JSON body of a query, and the validateQueryInputs function, which does not escape JSON metacharacters. This allows an attacker to inject malicious JSON code, potentially returning every document in the collection or modifying documents without authorization. The vulnerability affects Budibase versions prior to 3.39.12 and is fixed in version 3.39.12.

Defensive priority

This vulnerability has a CVSS score of 10 and a severity of CRITICAL. Budibase users and administrators should prioritize updating to version 3.39.12 or later as soon as possible.

Recommended defensive actions

  • Update to Budibase version 3.39.12 or later
  • Review published Budibase apps for potential modifications
  • Monitor for suspicious activity
  • Implement additional security measures, such as authentication and authorization, for Budibase apps
  • Review and update security configurations for Budibase installations

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and severity. The source item URL provides additional information on the vulnerability, including references to security advisories.

Official resources

This article is AI-assisted and based on the supplied source corpus.