# CVE-2026-73408: Budibase MySQL DESCRIBE backtick injection via multipleStatements

Source: https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73408 · Severity: high · CVSS 7.6 · Published 2026-08-13

Budibase is a low-code platform for building web applications and automations. The MySQL database connector fails to escape backticks in table names during schema introspection, allowing an attacker with the ability to create tables in the underlying MySQL database to inject arbitrary SQL statements. When a Budibase administrator refreshes the datasource schema, the malicious table name breaks out of the DESCRIBE query and executes attacker-controlled SQL, potentially leading to data theft, modification, or destruction.

Technologies: [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73408 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73408 being exploited in the wild.

**How severe is CVE-2026-73408?** High severity, with a CVSS score of 7.6, published 13 August 2026.

**Which products and versions are affected?** @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.

**Is there a fix for CVE-2026-73408?** A patch was published on 2026-06-16: Patch released in version 3.40.0; fix merged in PR #18989 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73408 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73408?** Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a SQL injection vulnerability (CWE-89) in Budibase's MySQL integration. The vulnerable code in packages/server/src/integrations/mysql.ts enables multipleStatements: true and constructs DESCRIBE queries by interpolating table names from INFORMATION_SCHEMA.TABLES directly into backtick-wrapped identifiers without escaping embedded backticks. An attacker with the ability to create tables in the target MySQL database can create a table with a name like `foo`; DROP TABLE users; --`, which when retrieved during schema introspection and passed to the unescaped DESCRIBE query, causes the backtick to terminate the identifier early and the semicolon-separated payload to execute as a second statement within the same round trip. Attack preconditions require the attacker to have table creation privileges on the MySQL database and requires a Budibase administrator to trigger schema discovery. The vulnerability was patched in version 3.40.0.

## Affected products

- Budibase Budibase <3.40.0

## Identifiers

- CVE-2026-73408
- GHSA-2xgg-r2wc-c5r2

## Timeline

- 2026-07-24: disclosed
- 2026-06-16: patched: Patch released in version 3.40.0; fix merged in PR #18989

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2](https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2)
- [https://github.com/Budibase/budibase/pull/18989](https://github.com/Budibase/budibase/pull/18989)
- [https://github.com/Budibase/budibase/commit/2c61f389c9986c91ddd8ae161c2b5e8ec21c60ac](https://github.com/Budibase/budibase/commit/2c61f389c9986c91ddd8ae161c2b5e8ec21c60ac)
- [https://github.com/Budibase/budibase](https://github.com/Budibase/budibase)
- [https://github.com/Budibase/budibase/releases/tag/3.39.18](https://github.com/Budibase/budibase/releases/tag/3.39.18)

## Related threats

- [Budibase S3 signed upload URL issuance via attachments endpoint](https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint)
- [Budibase automation SSRF in webhook and integration steps](https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps)
- [Budibase S3 presigned URL authorization regression](https://junglewise.ai/threats/cve-2026-72859-budibase-s3-presigned-url-authorization-regression)
- [Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api)
- [Budibase SSO OAuth2 token leakage via user metadata endpoints](https://junglewise.ai/threats/cve-2026-73304-budibase-sso-oauth2-token-leakage-via-user-metadata-endpoints)