Vulnerability details
CVE-2026-35216
Budibase budibase
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
CVSS 3.1
9.1Critical
Official description
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Budibase | budibase | < 3.33.4 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/Budibase/budibase/pull/18238 x_refsource_MISC
- https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256 x_refsource_MISC
- https://github.com/Budibase/budibase/releases/tag/3.33.4 x_refsource_MISC
- https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-03
- Last updated
- 2026-04-03
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
10.9%
Probability of exploitation in 30 days
95.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')