Executive brief
Budibase Server is a low-code platform that developers use to build web applications and connect to databases. Before version 3.45.0, when a Budibase builder saves or deletes a table connected to an external database, database passwords and API keys are sent unencrypted to other builders viewing the workspace. Any builder in the workspace can capture these credentials to compromise connected databases or third-party services.
Technical details
The vulnerability exists in packages/server/src/api/controllers/table/external.ts where datasource objects are broadcast over the Builder collaboration WebSocket room without redacting sensitive connection fields. Two broadcast call sites (updateTable and destroy) fail to call the existing sdk.datasources.removeSecretSingle() redaction helper before emitting the raw Datasource object. An authenticated Builder can intercept plaintext credentials (database passwords, API keys) by observing any external table update or delete operation.
Affected products
- Budibase Server before 3.45.0
Timeline
- 2026-09-26: advisory: GHSA-rmv5-3xpj-w885 published
- 2026-09-26: patched: Fixed in version 3.45.0