CVE-2026-35216

Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.

• CWE-78

• https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256Patch
• https://github.com/Budibase/budibase/pull/18238Issue Tracking, Patch
• https://github.com/Budibase/budibase/releases/tag/3.33.4Product, Release Notes
• https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hfExploit, Vendor Advisory
• https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hfExploit, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35210OpenCTI is an open source platform for managing cyber threat…7.1
• CVE-2026-35211OpenCTI is an open source platform for managing cyber threat…6.5
• CVE-2026-35212OpenCTI is an open source platform for managing cyber threat…6.1
• CVE-2026-35213@hapi/content provided HTTP Content-* headers parsing. All v…7.5
• CVE-2026-35214Budibase is an open-source low-code platform. Prior to versi…8.7
• CVE-2026-35215Firebird is an open-source relational database management sy…7.5
• CVE-2026-35217NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SU…6.5
• CVE-2026-35218Budibase is an open-source low-code platform. Prior to versi…8.7
• CVE-2026-35220Lack of CSRF token validation lead to a CSRF attack vector i…4.3
• CVE-2026-35221Improperly built filter clauses lead to a SQL injection vuln…9.8
• CVE-2026-35222Improperly validated order clauses lead to a SQL injection v…9.8
• CVE-2026-35223An improper access check allows unauthorized access to com_c…9.8