CVE-2026-54351: Budibase mass assignment in webhook trigger allows cross-workspace execution

CVE-2026-54351 · Severity: high · CVSS 8.2 · Published 2026-06-26

Budibase, an open-source low-code platform, contains a vulnerability that allows an attacker to execute automated tasks in another user's workspace. By sending a specially crafted request to a public webhook endpoint, an attacker can bypass security boundaries to read, modify, or delete data belonging to other organizations or tenants on the same server. This could lead to a complete compromise of sensitive customer databases and unauthorized access to internal environment variables.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-54351 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54351 being exploited in the wild.
How severe is CVE-2026-54351?
High severity, with a CVSS score of 8.2, published 26 June 2026.
Which products and versions are affected?
@budibase/server (npm) < 3.39.9, SEMVER:introduced=0,fixed=3.39.9.
Is there a fix for CVE-2026-54351?
Yes. @budibase/server (npm): upgrade to 3.39.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54351 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54351?
Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @budibase/server (npm): upgrade to 3.39.9 or later
    npm install @budibase/server@3.39.9

Technical details

A mass assignment vulnerability exists in the `externalTrigger()` function within `packages/server/src/automations/triggers.ts`. The webhook trigger endpoint is publicly accessible and spreads the attacker-controlled HTTP request body into the automation execution parameters, allowing the `appId` property to be overwritten. When processed asynchronously (the default for webhooks without a 'collect' step), the worker uses the attacker-supplied `appId` to set the workspace context. An attacker with builder access to their own workspace can exploit this to execute arbitrary automations (including 'Execute Script' or 'Query Rows') against a victim's database, provided they know the victim's workspace ID. The issue is fixed in version 3.39.9 by ensuring `appId` is server-controlled before queuing.

Affected products

  • Budibase budibase < 3.39.9

Identifiers

  • CVE-2026-54351
  • GHSA-rgvg-3wpc-h44p

Timeline

  • 2026-06-04: advisory: GitHub Security Advisory published by Budibase
  • 2026-06-26: disclosed: CVE published to NVD
  • 2026-06-26: patched: Fix confirmed in version 3.39.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.