CVE-2026-73408
Received Received - Intake

SQL Injection in Budibase via MySQL DESCRIBE Statement

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73408

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase budibase 3.39.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Budibase is an open-source low-code platform. Prior to version 3.39.18, a flaw in the MySQL integration allowed attackers to execute arbitrary SQL commands. The issue involved unescaped table names in a DESCRIBE statement, enabling stacked SQL injection if a table name contained special characters like backticks.

Detection Guidance

This vulnerability can be detected by checking the Budibase server version. If your version is below 3.39.18, the system is vulnerable. Inspect the server logs for schema discovery operations that may have executed unexpected statements.

Impact Analysis

An attacker could create a malicious MySQL table with a crafted name. If a Budibase administrator runs schema discovery, the second SQL statement in the table name executes, potentially leading to unauthorized data access, modification, or deletion. This requires the attacker to have MySQL table creation privileges.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be compromised if sensitive data is accessed or altered without authorization.

Mitigation Strategies

Upgrade Budibase to version 3.39.18 or later immediately. Review and sanitize any MySQL table names in your environment to prevent malicious injection. Monitor server logs for unauthorized schema changes or unexpected queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart