CVE-2026-64657 Budibase CVE debrief

Who should care

Budibase administrators and users with access to the PostgreSQL datasource connector configuration should verify if their instances are running version 3.39.19 or later and restrict access to the configuration.

Why it matters

CVE-2026-64657 is a high-severity vulnerability in Budibase's PostgreSQL datasource connector that allows authenticated administrators to execute arbitrary SQL. Defenders should verify instance versions, restrict administrator access, and monitor for potential SQL injection attempts.

• Potential for arbitrary SQL execution through the simple query protocol
• Possible data breaches or modifications through SQL injection
• Need for verification of instance version and administrator access controls
• Potential for lateral movement or privilege escalation

Technical summary

The Budibase PostgreSQL datasource connector interpolates a user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator to execute arbitrary SQL. This issue was fixed in version 3.39.19. The vulnerability affects Budibase instances prior to version 3.39.19 and can be exploited through the simple query protocol. Defenders should prioritize verifying instance versions and restricting administrator access to the PostgreSQL datasource connector configuration.

Defensive priority

Defenders should prioritize verifying if their Budibase instances are running version 3.39.19 or later, and restrict administrator access to the PostgreSQL datasource connector configuration.

Recommended defensive actions

• Verify if the Budibase instance is running version 3.39.19 or later
• Restrict administrator access to the PostgreSQL datasource connector configuration
• Monitor for potential SQL injection attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, the exact scope of affected deployments and potential exploitation attempts remain unknown. Budibase administrators should verify instance versions, restrict administrator access, and monitor for potential SQL injection attempts. Evidence from the CVE Program and NVD detail page supports this assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.