[ CVE-2026-100687 · Published 26 Sep 2026 ]
Vulnerability in budibase server
CVSS 5.5
EPSS <1%No fix listed yet
[ Description ]Official description
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.