Read the docs
TI-2026-30027 Aliases CVE-2026-41428GHSA-8783-3wgf-jggf

Improper authentication in budibase

Priority HIGH 72CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed budibase (Budibase): 3.35.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Budibasebudibasebefore 3.35.43.35.4Patch availableCNA
—@budibase/backend-core (npm)up to 3.35.3—No fix listedGHSA-8783-3wgf-jggf
  • budibase VendorBudibase Affected before 3.35.4 Fixed in 3.35.4 Patch available CNA
  • @budibase/backend-core (npm) Vendor— Affected up to 3.35.3 Fixed in — No fix listed GHSA-8783-3wgf-jggf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*before 3.35.4VulnerableBudibase
  • cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* Versions before 3.35.4 Vulnerable ·Budibase

Remediation

  • Fix · CNA budibase (Budibase) Fixed in 3.35.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41428
  2. 2026-10-03 Alias added: GHSA-8783-3wgf-jggf

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
  • TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
  • TI-2026-39244 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload CVSS 3.1CRITICAL 9.6
  • TI-2026-39243 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override CVSS 3.1CRITICAL 9.6
  • TI-2026-24371 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVSS 3.1CRITICAL 9.9
  • TI-2026-23473 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets CVSS 3.1CRITICAL 9.6
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences