CVE-2026-35216
Budibase, an open‑source low‑code platform, had a flaw that let anyone trigger a public webhook and run arbitrary Bash commands as root inside the container. The bug was fixed in version 3.33.4. Until that update, the server could be taken over without any login.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Budibase users running any version earlier than 3.33.4 on their own servers.
Real-world impact
An attacker could execute any command on the Budibase server as the root user, giving full control over the system, data, and any services running inside the container.
Why this severity
The CVSS score of 9 reflects that the vulnerability allows remote code execution with no authentication, giving complete compromise of confidentiality, integrity, and availability. The high attack complexity only indicates that the attacker must trigger a specific webhook, but the impact is still critical.
What to do about it
- 01Upgrade Budibase to version 3.33.4 or later.
NVD-referenced vendor advisory
Timeline
- Apr 3, 2026 · Apr 3, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/Budibase/budibase/commit/f0…patch
- github.com/Budibase/budibase/pull/1823…issue trackingpatch
- github.com/Budibase/budibase/releases/…productrelease notes
- github.com/Budibase/budibase/security/…exploitvendor advisory