Executive brief
Budibase is an open-source low-code platform used to build internal business applications. A security flaw in how the platform handles sensitive credentials allows authenticated users with low-level permissions to view secret keys for external integrations, such as Snowflake and Firebase, in plain text. This could allow an unauthorized user to gain full access to a company's external databases or cloud services, potentially leading to significant data theft or exposure.
Technical details
A vulnerability exists in the 'removeSecrets' function within 'packages/server/src/sdk/workspace/datasources/datasources.ts' which only masks fields explicitly typed as 'DatasourceFieldType.PASSWORD'. Several integrations, including Snowflake and Firebase, use the 'SENSITIVE_LONGFORM' type for private keys (PEM files), which the filtering logic bypasses. An authenticated user with 'BASIC' role permissions can query the '/api/datasources/:datasourceId' endpoint to retrieve these unmasked secrets. This occurs because the endpoint is guarded by 'PermissionLevel.READ', a level granted to standard app users. The issue is resolved in version 3.38.3 by extending the masking logic to include the 'SENSITIVE_LONGFORM' type.
Affected products
- Budibase Budibase < 3.38.3
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD
- 2026-05-27: patched: Fix released in version 3.38.3