Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100687Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
Medium 5.5
In plain English
A medium-severity information exposure in server from budibase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 82.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
References
- GitHub Security Advisory (GHSA-rmv5-3xpj-w885) vendor-advisory
- VulnCheck Advisory: Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast third-party-advisory