What is CVE-2026-72857?

CVE-2026-72857 is a high-severity vulnerability in Budibase, classified under Insufficiently Protected Credentials. CVSS score: 7.7/10. Published 2026-08-13.

How severe is CVE-2026-72857?

High severity. CVSS v3 base score is 7.7 out of 10.

Vulnerability in Budibase

CVE-2026-72857

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Affected products

Budibase — versions 0, 3.40.0

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-72857?: CVE-2026-72857 is a high-severity vulnerability in Budibase, classified under Insufficiently Protected Credentials. CVSS score: 7.7/10. Published 2026-08-13.
How severe is CVE-2026-72857?: High severity. CVSS v3 base score is 7.7 out of 10.