Description

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-13T22:17:24.450Z",
  "pubdate": "2026-08-13T22:17:24.450Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability exists in Budibase before version 3.40.0 within webhook-triggered automations that utilize EXECUTE_QUERY steps.\nThe vulnerability allows remote, unauthenticated attackers to supply malicious JSON payloads via HTTP POST requests directed to the webhook trigger endpoint.\nSuccessful exploitation results in the execution of arbitrary SQL commands using the builder-configured database credentials associated with the target datasources, such as Snowflake.\nThe business and operational impact is severe, enabling unauthorized data exfiltration, data modification, and persistence establishment within connected backend datasources.\nThe risk is elevated due to the lack of required authentication, allowing direct internet-facing exposure if the webhook endpoint is reachable without authorization controls.\nAttacker capabilities include complete compromise of the underlying connected database systems through automated query manipulation without prior system access.",
  "technicalDetails": "The root cause of the vulnerability stems from improper neutralization of user-supplied JSON input within webhook-triggered automations containing EXECUTE_QUERY steps.\nBudibase versions prior to 3.40.0 fail to adequately sanitize or parameterize input data passed through the webhook trigger endpoint before incorporating it into database queries executed by the application.\nThe vulnerable component is the automation handling engine responsible for processing webhook triggers and executing database queries.\nExploitation requires network access to the target Budibase instance webhook trigger endpoint, specifically targeting automations configured with EXECUTE_QUERY functionality.\nAuthentication is not required, meaning any remote actor can initiate the attack flow without valid credentials or session tokens.\nThe attack flow proceeds as follows: First, an attacker identifies or targets a publicly accessible webhook endpoint linked to an automation containing an EXECUTE_QUERY step. Second, the attacker crafts an HTTP POST request containing attacker-controlled JSON data engineered to break out of the intended query context and inject arbitrary SQL commands. Third, Budibase ingests the payload and passes the unvalidated input to the database query execution component. Fourth, the injected SQL payload is executed against connected datasources, such as Snowflake, leveraging the elevated privileges of the builder-configured database credentials.\nThe payload behavior involves direct execution of injected statements, allowing the retrieval, alteration, or deletion of database contents depending on the privileges assigned to the datasource configuration.\nPost-exploitation impact includes full data exfiltration of sensitive records, unauthorized data modification, and the creation of persistent database access mechanisms within the connected datasources."
}