Description

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-13T22:17:25.040Z",
  "pubdate": "2026-08-13T22:17:25.040Z",
  "executiveSummary": "An unredacted credential exposure vulnerability exists within Budibase before version 3.40.0, specifically impacting the handling of datasource configurations stored in STRING typed fields. The flaw allows authenticated users with table read permissions to retrieve sensitive backend credentials, such as MongoDB connection strings and Firebase private keys, in plaintext via the read API. This security deficiency poses significant risk implications by exposing critical infrastructure secrets, effectively granting unauthorized access to backend databases and external service accounts. Exploitation requires valid authentication and table read permissions within the application. The primary impact is the breach of confidentiality regarding critical database and service integrations managed through the platform, enabling potential lateral movement and deeper infrastructure compromise by malicious actors leveraging legitimately obtained credentials.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and redaction logic within Budibase prior to version 3.40.0, which fails to scrub sensitive authentication parameters stored within STRING typed fields when datasource configurations are serialized and transmitted through API endpoints. Specifically, the vulnerable components are the datasource configuration management and API response handling modules responsible for serving schema and table metadata. Attackers initiate the attack flow by authenticating to the Budibase instance with standard user credentials that include table read permissions. Once authenticated, the user queries the read API endpoints associated with table and datasource configurations. Because the application fails to mask or omit fields containing sensitive secrets, the server responds with unredacted JSON payloads containing plaintext secrets, including MongoDB connection URIs complete with administrative credentials and Firebase private service account keys. The exploitation method relies purely on authorized API interactions rather than memory corruption or injection vectors, bypassing any intended data masking layers. Post-exploitation impact includes the harvesting of high-value credentials, which attackers can subsequently use to directly access, modify, or exfiltrate data from connected backend databases and external cloud services operating outside the immediate perimeter of the Budibase application boundary."
}