CVE-2026-46427
HighSummary
Budibase is an open-source low-code platform that prior to version 3.38.3 did not properly mask sensitive data in the Snowflake integration. An authenticated BASIC user could retrieve the full PEM key in plaintext.
Risk Assessment
The organization may be exposed to sensitive data leaks, potentially leading to unauthorized access to systems and data. Proper security measures are crucial to protect against such incidents.
Recommendation
It is recommended to upgrade to version 3.38.3 or later to eliminate this vulnerability. Additionally, conducting a user permission audit and monitoring access to sensitive data is advisable.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource config fields whose schema type is DatasourceFieldType.PASSWORD. The Snowflake integration types its privateKey field as SENSITIVE_LONGFORM, which the filter skips. GET /api/datasources/:datasourceId lives on authorizedRoutes guarded by PermissionType.TABLE + PermissionLevel.READ. An authenticated BASIC user with any app role and call the endpoint and receive the full Snowflake PEM in plaintext. This vulnerability is fixed in 3.38.3.