CVE-2026-35216
CriticalCVSS 9.0Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
Budibase prior to version 3.33.4 allows an unauthenticated attacker to achieve Remote Code Execution (RCE) on the server by triggering an automation that contains a Bash step via the public webhook endpoint. The process executes as root inside the container.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary commands as root on the Budibase server, leading to full compromise of the application and its data.
Recommendation
Immediately update Budibase to version 3.33.4 or later.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.