External risk intelligence

Budibase Remote Code Execution via Public Webhook Automation.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-35216

Budibase is a low-code platform that utilizes public webhook endpoints for automation. Because the vulnerability is reachable through these public-facing endpoints without requiring authentication, the attack surface is exposed to the internet by design for standard platform functionality.

OS Command Injection

Budibase

before 3.33.4

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Budibase low-code platform allows unauthenticated attackers to execute commands remotely on affected servers. This occurs when an automation containing a Bash step is triggered through a public webhook. The vulnerability has been patched in version 3.33.4.

Remote code execution flaw found in low-code platform.
Affects platforms using public webhooks for automation.
Confirm Budibase relevance; investigate exposure.

Attack Path

How an attacker could exploit the issue

An attacker can execute arbitrary code on the Budibase server by sending a request to a public webhook endpoint. This request triggers an automation that includes a Bash step. Since no authentication is needed, an unauthenticated attacker can achieve remote code execution, with the process running as root within the container.

No authentication needed.
Triggered via public webhook.
Remote code execution as root.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could achieve Remote Code Execution on the Budibase server by triggering an automation with a Bash step through a public webhook. This could affect the server's integrity and allow an attacker to run commands as root within the container.

Server code execution.
Triggering via public webhook.
Unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform and infrastructure teams are likely responsible for managing the Budibase application. The first practical step is to identify all instances of Budibase, determine their exposure (especially those with public webhooks), and confirm accountability with the platform owner before planning remediation.

Identify Budibase instances and exposure.
Verify public webhook reachability and business criticality.
Plan remediation based on accountable owner and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Budibase?

Budibase is an open-source, low-code development platform. It is designed to help teams quickly build internal business applications, workflows, and automated processes without needing extensive traditional programming.

What does CVE-2026-35216 mean?

This CVE identifies a security weakness known as OS Command Injection (CWE-78). In simple terms, it means the application fails to properly validate input, allowing an attacker to insert and execute their own system-level commands through the platform's automation features.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted request to a public webhook endpoint associated with a Budibase automation that contains a Bash step. It is important to note that the bug is not triggered by standard application usage that does not involve these specific Bash-based automated workflows.

Is my Budibase instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your instance uses public webhooks for automation, as these are often exposed to the internet by design. If your Budibase deployment is accessible from the public internet, the potential for unauthorized access is significantly higher.

When should I update my software?

You should prioritize updating to version 3.33.4 or later immediately. As a first step, confirm if your instance is running an affected version and verify if any of your active automations utilize Bash steps, as this will help you gauge the priority of your update efforts.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.