Is CVE-2026-73408 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73408 being exploited in the wild.

How severe is CVE-2026-73408?

High severity, with a CVSS score of 7.6, published 13 August 2026.

Which products and versions are affected?

@budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.

Is there a fix for CVE-2026-73408?

A patch was published on 2026-06-16: Patch released in version 3.40.0; fix merged in PR #18989 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73408 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73408?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73408: Budibase MySQL DESCRIBE backtick injection via multipleStatements

CVE-2026-73408 · Severity: high · CVSS 7.6 · Published 2026-08-13

Budibase is a low-code platform for building web applications and automations. The MySQL database connector fails to escape backticks in table names during schema introspection, allowing an attacker with the ability to create tables in the underlying MySQL database to inject arbitrary SQL statements. When a Budibase administrator refreshes the datasource schema, the malicious table name breaks out of the DESCRIBE query and executes attacker-controlled SQL, potentially leading to data theft, modification, or destruction.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-73408 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73408 being exploited in the wild.
How severe is CVE-2026-73408?: High severity, with a CVSS score of 7.6, published 13 August 2026.
Which products and versions are affected?: @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.
Is there a fix for CVE-2026-73408?: A patch was published on 2026-06-16: Patch released in version 3.40.0; fix merged in PR #18989 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73408 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73408?: Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a SQL injection vulnerability (CWE-89) in Budibase's MySQL integration. The vulnerable code in packages/server/src/integrations/mysql.ts enables multipleStatements: true and constructs DESCRIBE queries by interpolating table names from INFORMATION_SCHEMA.TABLES directly into backtick-wrapped identifiers without escaping embedded backticks. An attacker with the ability to create tables in the target MySQL database can create a table with a name like `foo`; DROP TABLE users; --`, which when retrieved during schema introspection and passed to the unescaped DESCRIBE query, causes the backtick to terminate the identifier early and the semicolon-separated payload to execute as a second statement within the same round trip. Attack preconditions require the attacker to have table creation privileges on the MySQL database and requires a Budibase administrator to trigger schema discovery. The vulnerability was patched in version 3.40.0.

Affected products

Budibase Budibase <3.40.0

Identifiers

CVE-2026-73408
GHSA-2xgg-r2wc-c5r2

Timeline

2026-07-24: disclosed
2026-06-16: patched: Patch released in version 3.40.0; fix merged in PR #18989

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.