External risk intelligence

Budibase Unauthenticated Webhook SQL Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-72851

Budibase is a low-code platform commonly used to build and deploy web applications and public-facing automation endpoints. The vulnerability resides in a webhook-triggered automation endpoint, which is designed to be reachable via public network requests to facilitate integrations, making the attack surface publicly exposed by design.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability in Budibase, a low-code development platform, that could allow unauthorized access to connected data sources. The flaw lies within webhook-triggered automations, specifically when using EXECUTE_QUERY steps, enabling attackers to inject malicious SQL commands. This could potentially lead to the exfiltration or modification of sensitive information stored in linked databases, such as Snowflake, and allow for persistent access within those data sources.

Unauthenticated SQL injection in automation webhooks.
Impacts data integrity and access in connected systems.
Confirm relevance and exposure of connected data.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted JSON data to a webhook trigger endpoint without needing to authenticate. This allows them to inject malicious SQL code, which is then executed by the application using database credentials configured within the system. Successful exploitation could lead to unauthorized access, modification, or deletion of data stored in connected databases.

Unauthenticated access to webhook endpoint required.
Trigger automations with malicious SQL payloads.
Risk of data exfiltration, modification, persistence.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject SQL commands into webhook-triggered automations when supported by the advisory. This could affect connected data sources such as Snowflake by enabling unauthorized access to, modification of, or persistence within the data.

Connected data sources.
Via attacker-controlled JSON POST request.
Data exfiltration, modification, or persistence.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Budibase applications using webhook-triggered automations with the EXECUTE_QUERY step. Application owners or platform teams responsible for Budibase deployments should lead the response, coordinating with security and infrastructure teams. The initial step is to identify all Budibase instances, determine if they are exposed externally and contain affected automations, and assess business criticality before planning remediation.

Application owners should prioritize discovery.
Verify webhook automation exposure and criticality.
Plan phased remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Budibase and how is it used?

Budibase is a low-code platform for building web applications and business automations. It serves as an interface between users and data sources, allowing for the creation of tools to process and visualize information.

What is the nature of the vulnerability in CVE-2026-72851?

This vulnerability is classified as CWE-89, Improper Neutralization of Special Elements used in an SQL Command. It occurs because the application fails to adequately filter user-supplied input, allowing unauthorized SQL commands to be processed.

How is the SQL injection triggered?

The flaw is triggered when an attacker sends a crafted JSON POST request to a webhook-triggered automation endpoint. The vulnerability is specifically present when the automation utilizes EXECUTE_QUERY steps, though it does not require prior authentication.

Why is this vulnerability relevant to infrastructure security?

According to the Halo Surface Signal, this risk is very likely because the affected webhook endpoints are designed to be publicly reachable for integrations, which exposes the automation layer directly to external network requests.

How should organizations respond to this flaw?

Teams should identify all Budibase instances, assess the exposure of webhook automations using EXECUTE_QUERY steps, and prioritize remediation based on the business criticality of the connected data sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.