Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73410] Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outbo…

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-54356] Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/u…

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentia…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-64657] Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector …

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

14/08/2026

Regresión de autorización en Budibase 3.39.4-3.40.0 expone URLs firmadas de Amazon S3

Budibase versiones 3.39.4 anteriores a 3.40.0 contienen un fallo de control de acceso en el endpoint de carga de adjuntos S3. Usuarios con permisos BASIC pueden obtener URLs presignadas PutObject de buckets S3 arbitrarios, permitiendo escritura no autorizada en almacenamiento en la nube. Afecta directamente a empresas en LATAM que usan Budibase para gestión de contenidos y datos empresariales.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72857] Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowin…

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73305] Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign cal…

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, expos…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73408] Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mys…

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72849] Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff …

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inh…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72850] Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to…

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72851] Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered …

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72853] Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's p…

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72855] Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import …

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72856] Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/globa…

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC ap…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta de inyección NoSQL en Budibase anterior a 3.40.0

Budibase versiones anteriores a 3.40.0 contiene una vulnerabilidad de inyección NoSQL en su integración con MongoDB que permite a atacantes inyectar operadores MongoDB a través de parámetros de consulta, eludiendo controles de acceso por usuario. Los atacantes pueden leer documentos arbitrarios, ejecutar JavaScript malicioso y modificar datos en bases de datos MongoDB conectadas. Esta vulnerabilidad afecta principalmente a empresas en LATAM que utilizan Budibase para desarrollo de aplicaciones internas y plataformas de datos sin validación de entrada robusta.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

Inyección NoSQL alta en Budibase Server anterior a v3.40.0 afecta consultas MongoDB

Budibase Server versiones anteriores a 3.40.0 contienen una vulnerabilidad de inyección NoSQL en el endpoint de ejecución de consultas MongoDB. Atacantes con permisos de escritura de consultas pueden manipular parámetros JSON sin sanitizar, alterando queries para leer, modificar o eliminar documentos arbitrarios. El riesgo es alta (CVSS 8.3) en entornos que exponen esta funcionalidad a usuarios no confiables o integran Budibase en plataformas empresariales en LATAM.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73406] Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was…

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addres…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73303] Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibas…

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73300] Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Bu…

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.

nvdcriticovulnerabilidad CVSS 9.6 NVD

B Crítico vulnerabilidad

26/06/2026

[CVE-2026-54350] Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any p…

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write query, modifies every document of that collection with one HTTP request. enrichContext at packages/server…

nvdcriticovulnerabilidad CVSS 10.0 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-54351] Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budib…

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchron…

nvdaltovulnerabilidad CVSS 8.2 NVD