# CVE-2026-100687: Budibase Server plaintext credential exposure in external table broadcast

Source: https://junglewise.ai/threats/cve-2026-100687-budibase-server-before-3-45-0-fails-to-redact-plaintext  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100687 · Severity: medium · CVSS 5.5 · Published 2026-09-26

Budibase Server is a low-code platform that developers use to build web applications and connect to databases. Before version 3.45.0, when a Budibase builder saves or deletes a table connected to an external database, database passwords and API keys are sent unencrypted to other builders viewing the workspace. Any builder in the workspace can capture these credentials to compromise connected databases or third-party services.

Technologies: [Budibase Server](https://junglewise.ai/threats/technologies/budibase-server-1). Vendors: [Budibase](https://junglewise.ai/threats/vendors/budibase).

## Quick answers

**Is CVE-2026-100687 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100687 being exploited in the wild.

**How severe is CVE-2026-100687?** Medium severity, with a CVSS score of 5.5, published 26 September 2026.

**Which products and versions are affected?** Budibase Server before 3.45.0.

**Is there a fix for CVE-2026-100687?** A patch was published on 2026-09-26: Fixed in version 3.45.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100687 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100687?** Check whether you run Budibase Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in packages/server/src/api/controllers/table/external.ts where datasource objects are broadcast over the Builder collaboration WebSocket room without redacting sensitive connection fields. Two broadcast call sites (updateTable and destroy) fail to call the existing sdk.datasources.removeSecretSingle() redaction helper before emitting the raw Datasource object. An authenticated Builder can intercept plaintext credentials (database passwords, API keys) by observing any external table update or delete operation.

## Affected products

- Budibase Server before 3.45.0

## Timeline

- 2026-09-26: advisory: GHSA-rmv5-3xpj-w885 published
- 2026-09-26: patched: Fixed in version 3.45.0

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-rmv5-3xpj-w885](https://github.com/Budibase/budibase/security/advisories/GHSA-rmv5-3xpj-w885)
- [https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-credential-exposure-via-external-table-broadcast](https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-credential-exposure-via-external-table-broadcast)

## Related threats

- [Budibase server cross-tenant information disclosure in appPackage endpoint](https://junglewise.ai/threats/cve-2026-100688-budibase-server-before-3-45-0-contains-a-cross-tenant)
- [Budibase Server authentication bypass in OIDC/SSO invite reconcile](https://junglewise.ai/threats/cve-2026-100684-budibase-versions-3-41-0-before-3-45-0-contain-an-authentication)
- [Budibase Server arbitrary file write via ZIP symlink traversal](https://junglewise.ai/threats/cve-2026-100682-budibase-server-before-3-45-0-contains-an-arbitrary-file-write)