CVE-2026-100683
Received Received - Intake

SQL Injection via Column Renaming in Budibase

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename literal for MSSQL) without applying the project's quoteMySqlIdentifier / quoteSqlServerIdentifier helpers. An attacker with DDL rights on a connected MySQL/MSSQL datasource can create a column whose name contains a backtick (MySQL) or single quote (MSSQL) plus additional SQL; Budibase's schema introspection stores the name verbatim, and when a Budibase builder later renames that column through the UI (POST /api/tables with _rename.old), the embedded quote character terminates the identifier and the injected SQL is executed. Because the MySQL connection is opened with multipleStatements: true, stacked statements run as Budibase's datasource user, allowing arbitrary reads, writes, or destructive operations on the connected database outside Budibase's row/table permission model. Fixed in 3.45.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100683
EUVD
EUVD-2026-87656

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
budibase server to 3.45.0 (exc)
budibase budibase to 3.45.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a second-order SQL injection vulnerability in Budibase versions before 3.45.0. It occurs during column-rename operations for MySQL and MSSQL databases. The application constructs raw SQL queries by directly interpolating user-supplied identifiers without proper escaping. An attacker with DDL rights can create a malicious column name containing a backtick (MySQL) or single quote (MSSQL) followed by SQL code. When a Budibase user renames the column via the UI, the injected SQL executes with the Budibase datasource user's privileges, allowing arbitrary database operations.

Detection Guidance

Check Budibase server version with: curl -s http://your-budibase-server/api/version | grep version. If version is below 3.45.0, the system is vulnerable. Inspect MySQL/MSSQL logs for unusual DDL operations or stacked queries. Look for column names containing backticks or single quotes followed by SQL keywords.

Impact Analysis

An attacker could exploit this to read, modify, or delete data in the connected database outside Budibase's permission model. Since the attack runs with the Budibase datasource user's privileges, it may bypass application-level security controls. The vulnerability allows full database access, potentially leading to data theft, corruption, or unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, or integrity violations, potentially leading to regulatory penalties, fines, or loss of compliance certification.

Mitigation Strategies

Upgrade Budibase to version 3.45.0 or later immediately. Disable multipleStatements in MySQL connections if possible. Review database user permissions to limit DDL rights. Monitor for suspicious column renames or schema changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100683. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart