Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource config fields whose schema type is DatasourceFieldType.PASSWORD. The Snowflake integration types its privateKey field as SENSITIVE_LONGFORM, which the filter skips. GET /api/datasources/:datasourceId lives on authorizedRoutes guarded by PermissionType.TABLE + PermissionLevel.READ. An authenticated BASIC user with any app role and call the endpoint and receive the full Snowflake PEM in plaintext. This vulnerability is fixed in 3.38.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨*CVE* CVE-2026-46427 Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource con… https://www.cve.org/CVERecord?id=CVE-2026-46427 ----- Traducción: CVE-2026-46427 Bud… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑46427 in Budibase, highlighting incomplete secret masking in versions prior to 3.38.3.
CVE-2026-46427 Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource con… https://www.cve.org/CVERecord?id=CVE-2026-46427
Post summary
The tweet simply references CVE‑2026‑46427 with a link to the CVE record and a brief, incomplete note about 'removeSecrets' pre‑3.38.3, but provides no further exploit or mitigation details.