rootpwn

high · CVSS v3 5.5 · CVSS v4 7

CVE-2026-100687

Budibase Server versions prior to 3.45.0 broadcast unredacted datasource credentials over the Builder collaboration websocket. This flaw all

Overview

Budibase Server versions prior to 3.45.0 broadcast unredacted datasource credentials over the Builder collaboration websocket. This flaw allows any user with Builder access to capture database passwords and API keys during table updates. The exposure can lead to credential theft and potential lateral movement.

Description

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations.

Impact

Confidentiality is compromised as plaintext credentials are transmitted. Attackers with Builder access can harvest database passwords and API keys, enabling unauthorized database access. Integrity may be affected if credentials are tampered before use. Availability is not directly impacted.

Remediation

Upgrade Budibase Server to version 3.45.0 or later where the credential redaction bug is fixed. If an upgrade is not immediately possible, restrict Builder collaboration access to trusted users only and disable the websocket room for external table updates. Monitor websocket traffic for sensitive data and apply network segmentation to limit exposure.

Risk context

The CVE is rated high severity with CVSS v3 score 5.5 and CVSS v4 score 7.0, indicating a moderate to high risk of credential compromise. Defenders should treat this as a priority remediation item.

Affected products

  • Budibase Server

Scores

Severity
high
CVSS v2
6.8
CVSS v3
5.5
CVSS v4
7
EPSS
—

credential-exposure websocket Budibase confidentiality high-severity data-leak

← All CVEs

Related CVEs

high

CVE-2026-100644

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

View analysis

high

CVE-2026-100676

January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.

View analysis

high

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.

View analysis

high

CVE-2026-100692

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.

View analysis