CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
Attackers with Builder access can intercept unredacted database passwords and API keys by observing external table updates in Budibase Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100687?
CVE-2026-100687 is a high-severity vulnerability in budibase server, published on 26 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations.
Weakness: CWE-200
Which versions are affected by CVE-2026-100687?
How do I fix CVE-2026-100687?
No fix has been published for CVE-2026-100687 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100687 being exploited?
There is no known exploitation of CVE-2026-100687 in the wild and no public exploit code.
Sources
Also known as GHSA-qhcg-hgqm-ww52, GHSA-rmv5-3xpj-w885.