CVE-2026-73409 Budibase CVE debrief

Who should care

Defenders responsible for Budibase installations, particularly those using Budibase Cloud, should assess their exposure and verify their installations are updated to version 3.40.1 or later.

Why it matters

CVE-2026-73409 allows builders to submit absolute server paths and distinguish readable existing files from missing files, exposing a filesystem existence and readability oracle on the shared server. Defenders should verify their Budibase installations and ensure they are updated to version 3.40.1 or later.

• Verify Budibase installations are updated to version 3.40.1 or later to prevent exposure.
• Restrict access to /api/datasources/verify to prevent unauthorized file system probing.
• Monitor Budibase Cloud for suspicious activity related to file system access.

Technical summary

Budibase, an open-source low-code platform, had a vulnerability prior to version 3.40.1 where it passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. This allowed a builder to submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server.

Defensive priority

Defenders should prioritize verifying their Budibase installations and ensuring they are updated to version 3.40.1 or later.

Recommended defensive actions

• Verify Budibase installations and ensure they are updated to version 3.40.1 or later.
• Review and restrict access to /api/datasources/verify.
• Monitor Budibase Cloud for suspicious activity related to file system access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was fixed in version 3.40.1. Budibase Cloud was affected. The issue allowed builders to submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.