Executive brief
Budibase is a low-code platform used to build business applications. An unauthenticated attacker can trigger webhook-based automations by discovering the webhook's ID (a random UUID not kept secret) and send malicious JSON data that gets injected into SQL queries. This allows attackers to read, modify, or delete data in connected databases like Snowflake using the database credentials that the application builder configured, with no authentication required.
Technical details
The vulnerability is an unauthenticated SQL injection in Budibase's webhook automation trigger endpoint. Webhook triggers at POST /api/webhooks/trigger/:instance/:id are intentionally left public with no authentication requirement—the webhook ID is a non-secret UUID. When an attacker POSTs JSON to this endpoint, the JSON body is flattened into the automation trigger context. If the triggered automation contains an EXECUTE_QUERY step, the framework splices the attacker-controlled context values into the SQL query's parameterized bindings while bypassing per-user authentication resolution (isAutomation: true skips getAuthConfig). This results in SQL injection executed with the database credentials configured by the builder. Enterprise deployments with SYNC_AUTOMATIONS enabled also leak query results back to the unauthenticated caller via HTTP response, enabling direct data exfiltration. The vulnerability affects Budibase versions before 3.40.0 and is patched in 3.40.0 and later.
Affected products
- Budibase Budibase before 3.40.0
Timeline
- 2026-07-22: disclosed: GHSA-x7h8-ww3q-xv7c published by mjashanks
- 2026-07-22: patched: Fix released in version 3.40.0
- 2026-08-13: advisory: CVE-2026-72851 published