External risk intelligence

Budibase RestIntegration Credential Leakage Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-73407

Budibase is a low-code platform designed to function as a web application. The vulnerability exists within a public API endpoint, which is commonly exposed to the internet to facilitate external integrations, making it a likely target for network-based interaction.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Budibase open-source low-code platform, potentially allowing unauthorized access to sensitive credentials like bearer tokens. This issue arises from how the platform handles authentication headers when processing requests to external data sources. While the direct business impact is not yet determined, understanding its relevance to your deployed Budibase instances is key.

Platform flaw exposes stored credentials.
Affects publicly accessible API endpoints.
Confirm exposure and relevance for Budibase.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending a specially crafted request to a public API endpoint, causing the platform to unknowingly send stored credentials to an attacker-controlled server. This bypasses the intended security controls for data integration.

Requires public API endpoint access.
Triggered by sending a malicious query request.
Leads to exposure of sensitive credentials.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated caller of a public API endpoint could supply a crafted request to exfiltrate stored credentials associated with REST integrations. These credentials, such as bearer tokens or basic auth details, could be sent to an attacker-controlled host when interacting with specific query endpoints.

Stored integration credentials.
Malicious request to public API.
Sensitive data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Budibase platform's open-source nature and its deployment as a web application suggest that platform or application owners are responsible for addressing this vulnerability. The first step is to identify all instances of Budibase, determine their exposure and criticality, and locate the accountable owner. Remediation planning should then be prioritized based on this risk assessment.

Application or platform owners should manage this.
Verify public API endpoint exposure and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Budibase?

Budibase is an open-source, low-code platform used to build business applications. It allows developers to connect to various external data sources and automate workflows. By design, the platform handles data integration through REST APIs, which requires managing sensitive credentials like bearer tokens or basic authentication details to securely communicate with those external services.

What is the nature of the flaw in CVE-2026-73407?

This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory (CWE-22). In plain terms, the software fails to verify that the destination of a request matches the intended data source. Because of this, the platform can be tricked into sending stored credentials to an unauthorized server chosen by the requester.

How does an attacker trigger this credential leakage?

The flaw is triggered by sending a request to a public API endpoint within Budibase. By providing an absolute or parameterized path that points to an attacker-controlled host, the request causes the server to attach stored authentication headers to the outgoing connection. Simply interacting with internal-only, non-public API functions does not trigger this specific vulnerability.

Is my Budibase instance at risk?

Halo Surface Signal indicates that because this vulnerability involves a public API endpoint, any Budibase instance that is internet-facing is considered a likely target. If your deployment exposes these query-related API endpoints to the public internet, the risk is higher, as an attacker does not need authentication to initiate the malicious request.

How do I secure my environment against this vulnerability?

The primary response is to upgrade your Budibase software to version 3.40.1 or higher, which contains the fix for this issue. Before upgrading, identify all running instances of Budibase in your environment to ensure comprehensive coverage and coordinate with your team to prioritize this update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.