Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-72857Budibase before 3.40.0 Credential Exposure via STRING Fields
High 7.7
In plain English
A high-severity security flaw in budibase from Budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.4%top 70.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.
Affected products (as reported)
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-6mpp-gfg5-x2vv) vendor-advisory
- VulnCheck Advisory: Budibase before 3.40.0 Credential Exposure via STRING Fields third-party-advisory