CVE-2026-54351General(budibase / budibase)

LOWCVSS 9.6 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch budibase budibase systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim's workspace, granting full read/write access to the victim's database. This vulnerability is fixed in 3.39.9.

budibase CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-915

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

budibase

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
General: 2 classified signals
Disclosure: 2 classified signals
Peaked at 3 mentions on most recent observed day (2026-06-26)
4 total mentions across 2 days

Affected systems

Vendors

budibase

Products

budibase

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

General

250.0%

Disclosure

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-23	1	General1
2026-06-26	3	Disclosure2General1

Full discourse4 posts

Infoflowcloud@infoflowcloud87d
Disclosure
🚨*CVE* CVE-2026-54351 Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body i… https://www.cve.org/CVERecord?id=CVE-2026-54351 ----- Traducción: CVE-2026-54351 Bud… http://infoflow.cloud`
Post summary
The CVE relates to Budibase’s publicly accessible webhook trigger endpoint that exposes the entire HTTP request body; this issue is resolved in version 3.39.9.
0001032
89 followersView on X
CVE@CVEnew87d
Disclosure
CVE-2026-54351 Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body i… https://www.cve.org/CVERecord?id=CVE-2026-54351
Post summary
The post announces CVE‑2026‑54351, noting that Budibase versions before 3.39.9 expose a publicly accessible webhook trigger that leaks the full HTTP request body, and it implies patching via upgrading to 3.39.9.
00000718
57.7K followersView on X
MalwareObserver@MalwareObserver87d
General
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-54351](https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44p) Bu... https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44p #CVE #ZeroDay #PatchManagement
Post summary
The tweet announces the existence of CVE-2026-54351 and links to a GitHub advisory, but offers no additional technical details, PoC, or exploitation information.
0000039
6 followersView on X
DailyCVE@dailycve91d
General
🔴 Budibase, Mass Assignment via Webhook Trigger, #CVE-2026-54351 (High) -DC-Jun2026-571 https://dailycve.com/budibase-mass-assignment-via-webhook-trigger-cve-2026-54351-high-dc-jun2026-571/
Post summary
The entry highlights a high‑severity vulnerability (mass assignment via webhook trigger) in Budibase but provides no PoC, exploit, or patch details.
0000045
216 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	budibase	budibase	-	-	-

Explore more

Back to dashboard budibase CVEs budibase vulnerabilities

What researchers are saying

CVE-2026-54351

MalwareObserver[verified]@MalwareObserverGeneral

The tweet announces the existence of CVE-2026-54351 and links to a GitHub advisory, but offers no additional technical details, PoC, or exploitation information.

Infoflowcloud@infoflowcloudDisclosure

The CVE relates to Budibase’s publicly accessible webhook trigger endpoint that exposes the entire HTTP request body; this issue is resolved in version 3.39.9.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑54351, noting that Budibase versions before 3.39.9 expose a publicly accessible webhook trigger that leaks the full HTTP request body, and it implies patching via upgrading to 3.39.9.

DailyCVE@dailycveGeneral

The entry highlights a high‑severity vulnerability (mass assignment via webhook trigger) in Budibase but provides no PoC, exploit, or patch details.