CVE-2026-100683

Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename literal for MSSQL) without applying the project's quoteMySqlIdentifier / quoteSqlServerIdentifier helpers. An attacker with DDL rights on a connected MySQL/MSSQL datasource can create a column whose name contains a backtick (MySQL) or single quote (MSSQL) plus additional SQL; Budibase's schema introspection stores the name verbatim, and when a Budibase builder later renames that column through the UI (POST /api/tables with _rename.old), the embedded quote character terminates the identifier and the injected SQL is executed. Because the MySQL connection is opened with multipleStatements: true, stacked statements run as Budibase's datasource user, allowing arbitrary reads, writes, or destructive operations on the connected database outside Budibase's row/table permission model. Fixed in 3.45.0.

• CWE-89

• https://github.com/Budibase/budibase/security/advisories/GHSA-ppj8-hmx2-m546
• https://www.vulncheck.com/advisories/budibase-before-3.45.0-sql-injection-via-column-rename-ddl

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100678stoatchat before 0.15.5 fails to enforce account-level attem…6.5
• CVE-2026-100679stoatchat before 0.15.5 fails to validate that MFA tickets b…8.8
• CVE-2026-10068A flaw has been found in Shibby Tomato 1.28. The affected el…7.3
• CVE-2026-100680Budibase versions before 3.45.0 fail to disable external JSO…8.1
• CVE-2026-100681Budibase before 3.45.0 contains an unauthenticated server-si…5.4
• CVE-2026-100682Budibase Server before 3.45.0 contains an arbitrary file wri…8.8
• CVE-2026-100684Budibase versions 3.41.0 before 3.45.0 contain an authentica…8.1
• CVE-2026-100685Budibase before 3.45.0 fails to properly scope the GET /api/…7.7
• CVE-2026-100686Budibase versions before 3.45.0 fail to validate per-app aut…8.1
• CVE-2026-100687Budibase Server before 3.45.0 fails to redact plaintext data…5.5
• CVE-2026-100688Budibase server before 3.45.0 contains a cross-tenant inform…6.5
• CVE-2026-100689GitPython before 3.1.62 does not validate the `path` field r…5.9