CVE-2026-72851

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

Affected products

Budibase, Snowflake

Fix

Available

CVSS 3.1

10.0 CRITICAL

EPSS

0.3% (21th percentile)

Weakness

CWE-89

NVD status

Deferred

Published

2026-08-13