Is CVE-2026-54356 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54356 being exploited in the wild.

How severe is CVE-2026-54356?

High severity, with a CVSS score of 7.1, published 26 August 2026.

Which products and versions are affected?

@budibase/server (npm) <= 3.38.1, SEMVER:introduced=0,last_affected=3.38.1.

Is there a fix for CVE-2026-54356?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54356 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54356?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54356: Budibase S3 signed upload URL issuance via attachments endpoint

Q: Is there a fix for CVE-2026-54356?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-54356 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-54356?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54356 · Severity: high · CVSS 7.1 · Published 2026-08-26

Budibase, a low-code application development platform, contains a flaw in its file attachment API that allows low-privilege users to generate arbitrary AWS S3 upload URLs using the server's stored cloud credentials. An attacker with basic app access could craft requests to upload files to any S3 bucket and location that the server has permission to write to, enabling data injection, malware distribution, or service disruption through cloud storage compromise.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-54356 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54356 being exploited in the wild.
How severe is CVE-2026-54356?: High severity, with a CVSS score of 7.1, published 26 August 2026.
Which products and versions are affected?: @budibase/server (npm) <= 3.38.1, SEMVER:introduced=0,last_affected=3.38.1.
Is there a fix for CVE-2026-54356?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54356 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54356?: Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in Budibase's attachment API endpoint. The endpoint at POST /api/attachments/:datasourceId/url is intended to generate pre-signed S3 upload URLs, but fails to properly restrict which buckets and object keys low-privilege users can target. An authenticated user with the built-in BASIC role on a published app can send a request with attacker-controlled bucket and key parameters to the endpoint, which returns a valid AWS signature valid for 900 seconds. The authorization middleware (authorized.ts, resourceId.ts) does not enforce appropriate scope limits, allowing lateral privilege escalation from development-context restrictions (which correctly return 403) to published-app context. The datasource credentials are fetched server-side and used to sign the URLs, enabling the attacker to abuse production cloud infrastructure permissions. No patch has been released as of the advisory date.

Affected products

Budibase @budibase/server <= 3.38.1

Identifiers

CVE-2026-54356
GHSA-6x9p-4r67-5gjx

Timeline

2026-08-26: disclosed: GitHub Advisory published
2026-08-14: advisory: Reviewed by GitHub
2026-08-17: other: Published to NVD
2026-03-41: other: Patch released in version 3.41.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.