CVE-2026-54351

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim's workspace, granting full read/write access to the victim's database. This vulnerability is fixed in 3.39.9.

• CWE-915

• https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44pExploit, Mitigation, Vendor Advisory
• https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44pExploit, Mitigation, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54344ToolJet is an open-source low-code platform for building int…8.8
• CVE-2026-54345gopacket provides packet processing capabilities for Go. In …7.5
• CVE-2026-54347Froxlor is open source server administration software. Prior…8.7
• CVE-2026-54348Froxlor is open source server administration software. Prior…7.2
• CVE-2026-5435The deprecated functions ns_printrrf, ns_printrr and fp_nque…7.3
• CVE-2026-54350Budibase is an open-source low-code platform. Prior to 3.39.…9.8
• CVE-2026-54352Budibase is an open-source low-code platform. Prior to 3.39.…9.6
• CVE-2026-54353Budibase is an open-source low-code platform. Prior to 3.39.…7.1
• CVE-2026-54354MapServer is a system for developing web-based GIS applicati…8.2
• CVE-2026-54355MapServer is a system for developing web-based GIS applicati…5.3
• CVE-2026-54356Budibase is an open-source low-code platform. Prior to 3.41.…7.1
• CVE-2026-54357An improper authorization vulnerability in MISP allowed an a…5.1