CVE-2026-72857

HighCVSS 7.7

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations via the read API to obtain live backend database credentials and service account keys.

Risk Assessment

The risk is the exposure of sensitive credentials, potentially leading to unauthorized access to databases and external services, compromising data confidentiality.

Recommendation

Upgrade Budibase to version 3.40.0 or later, which includes the credential redaction fix.

Original NVD description (English source)

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.