PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73408 Budibase CVE debrief

Budibase, an open-source low-code platform, had a vulnerability prior to version 3.39.18. The packages/server/src/integrations/mysql.ts file enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker who could create a MySQL table with a backtick and stacked statement in its name could potentially execute a second statement when a Budibase administrator ran schema discovery. The issue was fixed by applying quoteMySqlIdentifier before constructing the query in version 3.39.18.

Vendor
Budibase
Product
Unknown
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-13
Original CVE updated
2026-09-08
Advisory published
2026-08-13
Advisory updated
2026-09-08

Who should care

Budibase administrators and users, especially those utilizing MySQL integrations, should assess their exposure and prioritize verification of their systems. This includes verifying if the MySQL integration is used, checking the Budibase version, assessing the exposure of administrators to schema discovery, and reviewing MySQL table names for potential vulnerabilities.

Why it matters

CVE-2026-73408 is a high-severity vulnerability in Budibase's MySQL integration that could allow attackers to execute stacked statements. Budibase administrators and users, especially those utilizing MySQL integrations, should assess their exposure and prioritize verification of their systems.

  • Potential execution of unintended MySQL statements
  • Elevation of privileges for attackers with MySQL table creation capabilities
  • Increased risk of data breaches or system compromise
  • Verification priority for Budibase administrators and users

Technical summary

The vulnerability in Budibase's MySQL integration allowed for potential execution of stacked statements due to unescaped table names in DESCRIBE statements. The issue was fixed in version 3.39.18 by applying quoteMySqlIdentifier. Budibase administrators and users, especially those utilizing MySQL integrations, should assess their exposure and prioritize verification of their systems. This involves reviewing MySQL table names for potential backtick and stacked statement vulnerabilities and verifying the Budibase version.

Defensive priority

Budibase administrators and users should assess exposure and prioritize verification of their systems, especially those using MySQL integrations.

Recommended defensive actions

  • Verify if the MySQL integration is used in the Budibase setup
  • Check if the Budibase version is 3.39.18 or later
  • Assess the exposure of Budibase administrators to schema discovery
  • Review MySQL table names for potential backtick and stacked statement vulnerabilities
  • Confirm whether affected Budibase deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, the actual exploitation and affected scope require verification from the supplied official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73408 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73408

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73408 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73408

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.