Vulnerability in Budibase
CVE-2026-72857
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (26.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Budibase — versions 0, 3.40.0
Weakness classification (CWE)
References
- github.com/Budibase/budibase/security/advisories/GHSA-6mpp-gfg5-x2vv (vendor-advisory)
- www.vulncheck.com/advisories/budibase-before-credential-exposure-via-string-fie… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-72857?
- CVE-2026-72857 is a high-severity vulnerability in Budibase, classified under Insufficiently Protected Credentials. CVSS score: 7.7/10. Published 2026-08-13.
- How severe is CVE-2026-72857?
- High severity. CVSS v3 base score is 7.7 out of 10.