Is CVE-2026-45717 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45717 being exploited in the wild.

How severe is CVE-2026-45717?

High severity, with a CVSS score of 8.8, published 27 May 2026.

Which products and versions are affected?

@budibase/server (npm) < 3.38.1, SEMVER:introduced=0,fixed=3.38.1.

Is there a fix for CVE-2026-45717?

Yes. @budibase/server (npm): upgrade to 3.38.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45717 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45717?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45717: Budibase missing authorization in datasource management API

Q: Is there a fix for CVE-2026-45717?

Yes. @budibase/server (npm): upgrade to 3.38.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45717 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-45717?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45717 · Severity: high · CVSS 8.8 · Published 2026-05-27

Budibase is a low-code platform that connects to external databases and APIs through datasources. An authorization flaw allows any authenticated user with the BASIC role (the lowest non-public role assigned to all app users) to modify datasource connection settings, including the server host, port, and credentials. An attacker can redirect a datasource to internal IP addresses to probe private networks, exfiltrate metadata from cloud services, or break all application queries for legitimate users by injecting invalid configurations.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-45717 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45717 being exploited in the wild.
How severe is CVE-2026-45717?: High severity, with a CVSS score of 8.8, published 27 May 2026.
Which products and versions are affected?: @budibase/server (npm) < 3.38.1, SEMVER:introduced=0,fixed=3.38.1.
Is there a fix for CVE-2026-45717?: Yes. @budibase/server (npm): upgrade to 3.38.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45717 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45717?: Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@budibase/server (npm): upgrade to 3.38.1 or later
```
npm install @budibase/server@3.38.1
```

Technical details

The vulnerability is an RBAC bypass in datasource management. The PUT /api/datasources/:datasourceId route is registered under authorizedRoutes with TABLE/READ permission check, the same level as the read-only GET endpoint. However, destructive operations (create, delete, verify) correctly use builderRoutes. The authorization middleware allows any BASIC-role user (who carries TABLE/WRITE implicitly) to pass the check, and the datasource controller performs no additional builder-level authorization guard. The mergeConfigs function does not restrict non-password fields (host, port, database, url, ssl), allowing attackers to supply arbitrary connection parameters. Attack vectors include: (1) SSRF via SQL driver redirection to cloud metadata endpoints or internal services at arbitrary ports; (2) SSRF via REST datasource URL rewriting; (3) denial of service by corrupting datasource config. Patch is available in version 3.38.1.

Affected products

Budibase @budibase/server <3.38.1

Identifiers

CVE-2026-45717
GHSA-44m2-crh7-f4q2

Timeline

2026-05-15: disclosed: GHSA-44m2-crh7-f4q2 published
2026-05-12: patched: Version 3.38.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.