CVE-2026-72857

Received Received - Intake

Budibase Credential Exposure in STRING Fields

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72857

EUVD

EUVD-2026-58506

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	to 3.40.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

Budibase before version 3.40.0 has a flaw where datasource credentials stored in STRING typed fields are not properly redacted. This allows authenticated users to view sensitive information like MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can exploit this by retrieving datasource configurations through the read API to access live backend database credentials and service account keys.

Detection Guidance

Check Budibase instances for unredacted credentials in STRING typed fields by querying the read API for table data. Look for plaintext MongoDB connection strings or Firebase private keys in responses.

Impact Analysis

This vulnerability allows attackers with read access to obtain sensitive backend credentials. They could use these to access databases, modify data, or interact with connected services like Firebase. Organizations using Budibase may face data breaches, unauthorized access, or service disruptions if exploited.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal or health data. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A breach could result in legal penalties, fines, and reputational damage for affected organizations.

Mitigation Strategies

Upgrade Budibase to version 3.40.0 or later to ensure proper redaction of credentials. Review and rotate any exposed MongoDB connection strings or Firebase private keys.

Hi! I’m here to help you understand CVE-2026-72857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70