Signal is active with 5 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | Disclosure1 |
| 2026-05-21 | 5 | Disclosure1General2Patch2 |
TL;DR Budibase versions prior to 3.35.4 contain a critical authentication bypass flaw (CVE-2026-41428, CVSS 9.1) that allows unauthenticated attackers to access protected API endpoints. The root cause: unanchored regular expressions in the auth middleware. Update…
Post summary
Budibase versions before 3.35.4 are vulnerable to CVE-2026-41428, a critical authentication bypass flaw; updating to the latest release resolves the issue.
What Happened On April 24, 2026, security researchers disclosed CVE-2026-41428, a critical authentication bypass vulnerability in the open-source Budibase low-code platform. The flaw affects all versions prior to 3.35.4 and allows an attacker with network access to…
Post summary
The snippet announces CVE-2026-41428, an authentication bypass affecting Budibase versions before 3.35.4, without providing PoC, exploitation, or patch details.
Sources TheHackerWire - Budibase Critical Auth Bypass via Unanchored Regex (CVE-2026-41428) NVD - CVE-2026-41428 Budibase GitHub - Release 3.35.4 CVSS 4.0 Scoring
Post summary
CVE-2026-41428 is a critical authentication bypass in Budibase caused by unanchored regex, but the vulnerability has been patched in release 3.35.4 with a CVSS 4.0 score provided.
https://lyrie.ai/research/research/2026-04-26-budibase-auth-bypass-cve-2026-41428 #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
A research link about CVE‑2026‑41428 is shared, but the post contains no detailed technical info, exploit code, or mitigation guidance.
https://lyrie.ai/research/research/2026-04-26-budibase-auth-bypass-cve-2026-41428 #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post only includes a URL and generic tags, providing no concrete evidence or details about the CVE.
CVE-2026-41428 Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint pat… https://www.cve.org/CVERecord?id=CVE-2026-41428
Post summary
CVE‑2026‑41428 affects Budibase's authenticated middleware by using unanchored regexes for public endpoints, allowing bypass; the issue is mitigated in version 3.35.4.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | budibase | budibase | - | - | - |