CVE-2026-54351

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim's workspace, granting full read/write access to the victim's database. This vulnerability is fixed in 3.39.9.

• CWE-915

• https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44pExploit, Mitigation, Vendor Advisory
• https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44pExploit, Mitigation, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54341Dragonfly is an in-memory data store built for modern applic…7.5
• CVE-2026-54342In epa4all, prior to version 2026-05-20, an attacker on the …8.1
• CVE-2026-54344ToolJet is an open-source low-code platform for building int…4.7
• CVE-2026-54345gopacket provides packet processing capabilities for Go. In …7.5
• CVE-2026-5435The deprecated functions ns_printrrf, ns_printrr and fp_nque…7.3
• CVE-2026-54350Budibase is an open-source low-code platform. Prior to 3.39.…9.8
• CVE-2026-54352Budibase is an open-source low-code platform. Prior to 3.39.…9.6
• CVE-2026-54353Budibase is an open-source low-code platform. Prior to 3.39.…7.1
• CVE-2026-54357An improper authorization vulnerability in MISP allowed an a…5.1
• CVE-2026-54358An incorrect authorization vulnerability in MISP allows an o…7.5
• CVE-2026-54359MISP contains an insecure default configuration in which the…7.1
• CVE-2026-5436The MW WP Form plugin for WordPress is vulnerable to Arbitra…8.1