# CVE-2026-54351: Budibase mass assignment in webhook trigger allows cross-workspace execution

Source: https://junglewise.ai/threats/cve-2026-54351-budibase-mass-assignment-in-webhook-trigger-allows-cross  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-54351 · Severity: high · CVSS 8.2 · Published 2026-06-26

Budibase, an open-source low-code platform, contains a vulnerability that allows an attacker to execute automated tasks in another user's workspace. By sending a specially crafted request to a public webhook endpoint, an attacker can bypass security boundaries to read, modify, or delete data belonging to other organizations or tenants on the same server. This could lead to a complete compromise of sensitive customer databases and unauthorized access to internal environment variables.

Technologies: [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54351 being exploited in the wild.

**How severe is CVE-2026-54351?** High severity, with a CVSS score of 8.2, published 26 June 2026.

**Which products and versions are affected?** @budibase/server (npm) < 3.39.9, SEMVER:introduced=0,fixed=3.39.9.

**Is there a fix for CVE-2026-54351?** Yes. @budibase/server (npm): upgrade to 3.39.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54351 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54351?** Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @budibase/server (npm): upgrade to 3.39.9 or later

  ```sh
  npm install @budibase/server@3.39.9
  ```


## Technical details

A mass assignment vulnerability exists in the `externalTrigger()` function within `packages/server/src/automations/triggers.ts`. The webhook trigger endpoint is publicly accessible and spreads the attacker-controlled HTTP request body into the automation execution parameters, allowing the `appId` property to be overwritten. When processed asynchronously (the default for webhooks without a 'collect' step), the worker uses the attacker-supplied `appId` to set the workspace context. An attacker with builder access to their own workspace can exploit this to execute arbitrary automations (including 'Execute Script' or 'Query Rows') against a victim's database, provided they know the victim's workspace ID. The issue is fixed in version 3.39.9 by ensuring `appId` is server-controlled before queuing.

## Affected products

- Budibase budibase < 3.39.9

## Identifiers

- CVE-2026-54351
- GHSA-rgvg-3wpc-h44p

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published by Budibase
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fix confirmed in version 3.39.9

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44p](https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44p)

## Related threats

- [Budibase S3 signed upload URL issuance via attachments endpoint](https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint)
- [Budibase automation SSRF in webhook and integration steps](https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps)
- [Budibase S3 presigned URL authorization regression](https://junglewise.ai/threats/cve-2026-72859-budibase-s3-presigned-url-authorization-regression)
- [Budibase MySQL DESCRIBE backtick injection via multipleStatements](https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements)
- [Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api)