CVE-2026-35216
critical · 9Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
9
CVSS
10.7%
EPSS (exploit prob.)
96th
EPSS percentile
2026-04-03
Published
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| budibase | budibase | < 3.33.4 |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256
- https://github.com/Budibase/budibase/pull/18238
- https://github.com/Budibase/budibase/releases/tag/3.33.4
- https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf
- https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-35216