Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-46427Budibase: Snowflake private key returned unmasked from datasource API to BASIC users

High 7.7

In plain English

A high-severity information exposure in budibase from Budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource config fields whose schema type is DatasourceFieldType.PASSWORD. The Snowflake integration types its privateKey field as SENSITIVE_LONGFORM, which the filter skips. GET /api/datasources/:datasourceId lives on authorizedRoutes guarded by PermissionType.TABLE + PermissionLevel.READ. An authenticated BASIC user with any app role and call the endpoint and receive the full Snowflake PEM in plaintext. This vulnerability is fixed in 3.38.3.

Affected products (as reported)

Vendor	Product	Versions
Budibase	budibase	< 3.38.3

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/Budibase/budibase/security/advisories/GHSA-qv26-4hvj-m7fv x_refsource_CONFIRM