CVE-2026-72851

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.40.0

Description An unauthenticated SQL injection exists in webhook-triggered automations that utilize EXECUTE QUERY steps. An attacker can send a POST request containing malicious JSON to the webhook trigger endpoint to inject SQL payloads. These payloads execute using the database credentials configured by the builder, which may allow for data exfiltration, modification, and the establishment of persistence within connected datasources, such as Snowflake.

Recommendations Update Budibase to version 3.40.0 or later.