Description

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-26T14:16:53.140Z",
  "pubdate": "2026-09-26T14:16:53.140Z",
  "executiveSummary": "This vulnerability involves an improper redaction flaw in the Budibase Server's websocket communication layer. Specifically, the Builder collaboration websocket room broadcasts internal datasource objects that include plaintext credentials to all connected clients.\nThe issue affects Budibase Server versions prior to 3.45.0. It allows authenticated users with 'Builder' level access to intercept sensitive configuration data, including database passwords and API keys, during table update or deletion operations.\nThe primary risk is unauthorized credential exposure, potentially leading to privilege escalation, lateral movement, or full compromise of connected downstream data stores. Exploitation requires the attacker to have legitimate access to the Builder interface and the capability to monitor websocket traffic directed toward the collaboration room. There are no requirements for external network access as the exposure occurs within the application's internal messaging infrastructure. This vulnerability poses a critical risk to the confidentiality of configured backend integrations.",
  "technicalDetails": "The vulnerability resides within the Budibase Server websocket broadcast mechanism, specifically the handler responsible for synchronizing table state updates across the Builder collaboration environment. When a user performs a save or delete operation on an external table, the application broadcasts the updated table schema and configuration metadata to all active participants in the collaboration room to ensure state consistency.\nThe root cause is an insecure implementation of the object serialization process during these websocket broadcasts. The application fails to sanitize or redact the datasource object before transmitting it over the websocket protocol. Consequently, sensitive fields—intended to be stored in the server-side configuration—are included in the JSON payload transmitted to the client-side Builder environment.\nAn attacker with Builder-level authentication can exploit this by initializing a WebSocket connection to the collaboration room and monitoring incoming frames during synchronization events. By observing the payloads associated with 'table save' or 'table delete' operations, an attacker can capture the full datasource definition. Because these objects contain raw connection strings, database credentials, and third-party API keys, the information is immediately actionable.\nThe attack flow follows these steps: 1. The attacker authenticates to the Budibase Builder environment. 2. The attacker establishes a websocket connection to the collaboration room, mimicking standard client behavior. 3. The attacker triggers a table operation or waits for another authenticated builder to perform one. 4. The server broadcasts the unredacted datasource object to all connected clients. 5. The attacker inspects the websocket message body to extract plaintext credentials. 6. The attacker uses the exfiltrated credentials to gain unauthorized access to the underlying external database or API.\nThe vulnerable component is the server-side message dispatcher that broadcasts state changes without applying necessary access control or data filtering logic to the websocket frame. This exposure occurs exclusively within versions prior to 3.45.0. Since this relies on the websocket protocol for state synchronization, the vulnerability is inherent to the server's broadcast logic and does not require complex payload injection; it is a passive interception of over-privileged data broadcast by the server itself."
}