CVE-2026-73407

Received Received - Intake

Remote Code Execution in Budibase Prior to 3.40.1

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId query could supply an absolute or parameterized path to an attacker-controlled host and receive the stored bearer, basic, or static-header credentials. This issue is fixed in version 3.40.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73407

EUVD

EUVD-2026-57413

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	3.40.1
budibase	server	From 3.40.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Budibase (CVE-2026-73407) allows unauthenticated attackers to steal REST datasource credentials by redirecting requests to attacker-controlled hosts. The flaw occurs because credentials are attached to outgoing requests before validating the destination URL against the datasource's origin. Attackers can manipulate query paths to redirect requests to malicious servers, especially if queries are publicly accessible.

Detection Guidance

To detect this vulnerability, check if your Budibase server version is below 3.40.1. Inspect network logs for POST requests to /api/v2/queries/:queryId with absolute or parameterized URLs pointing to external hosts. Look for exposed credentials in responses or error messages.

Impact Analysis

An attacker could exfiltrate sensitive credentials like API keys, bearer tokens, or basic auth headers with a single HTTP request. These stolen credentials could then be used to impersonate the victim organization, access restricted data, or perform unauthorized actions on behalf of the compromised system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected Budibase versions may face compliance breaches, potential data breaches, and regulatory penalties due to the exposure of authentication credentials and unauthorized data access.

Mitigation Strategies

Upgrade Budibase server to version 3.40.1 or later immediately. Review and restrict access to PUBLIC queries. Ensure no sensitive credentials are stored in datasources without validation. Monitor for unauthorized requests to external hosts.

Hi! I’m here to help you understand CVE-2026-73407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70