CVE-2026-19754 Overview
CVE-2026-19754 is a SQL injection vulnerability [CWE-89] in Baserow 2.3.3 affecting the index() formula function. Low-privileged authenticated users who can create or modify formula fields can supply an undocumented fourth argument that Baserow interprets as a SQL template. The argument is interpolated directly into a PostgreSQL expression and executed during formula recalculation. The injected SQL runs under the privileges of the Baserow PostgreSQL role, not the application user, which enables data access and modification beyond the attacker's application-level permissions.
Critical Impact
An authenticated attacker with formula field creation rights can execute arbitrary SQL against the underlying PostgreSQL database with the Baserow service account's privileges.
Affected Products
- Baserow 2.3.3
Discovery Timeline
- 2026-09-02 - CVE-2026-19754 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-19754
Vulnerability Analysis
Baserow exposes a formula language for computed fields. The index() formula function accepts an undocumented fourth argument that is treated as a SQL template string rather than a bound parameter. Baserow interpolates this argument directly into a PostgreSQL expression that is compiled when formula field values are recalculated. Because the interpolation occurs before parameterization, attacker-controlled text becomes part of the query text itself. Any user with permission to create or edit formula fields in a table can introduce this expression.
Root Cause
The root cause is missing input sanitization on the fourth argument of the index() formula function. Baserow's formula compiler does not validate or parameterize this argument before concatenating it into generated SQL. The undocumented parameter path bypasses the argument-count and type checks applied to documented formula arguments, leaving no barrier between user input and the SQL executed against PostgreSQL.
Attack Vector
An authenticated user with permission to modify formula fields creates or edits a formula that invokes index() with a crafted fourth argument. When Baserow recalculates the formula, the injected SQL executes through Baserow's database connection. The generated statements run with the privileges of the Baserow PostgreSQL role, allowing the attacker to read, modify, or delete data across all Baserow-managed tables regardless of application-level permissions.
See the Fluid Attacks Security Advisory for the disclosure details and the GitHub Baserow Repository for source code context.
Detection Methods for CVE-2026-19754
Indicators of Compromise
- Formula field definitions that invoke index() with four arguments, particularly where the fourth argument contains SQL keywords such as SELECT, UNION, INSERT, UPDATE, DROP, or comment sequences like -- and /*.
- PostgreSQL query logs showing unexpected statements originating from the Baserow application role during formula recalculation.
- Unexplained data changes in Baserow-owned tables or access to system catalog tables like pg_catalog.pg_user.
Detection Strategies
- Audit the formula field definitions stored in Baserow's metadata for occurrences of index( followed by four comma-separated arguments.
- Enable PostgreSQL log_statement = 'all' on non-production instances and inspect generated SQL for injected fragments during formula recalculation.
- Correlate application audit events for formula field create or update actions with subsequent database query anomalies.
Monitoring Recommendations
- Forward Baserow application logs and PostgreSQL logs to a centralized analytics platform and alert on formula-related SQL errors or long-running queries during recalculation.
- Monitor low-privileged accounts that begin creating or editing formula fields, especially outside normal working hours.
- Track database role activity to identify statements issued by the Baserow role that access tables outside the expected schema.
How to Mitigate CVE-2026-19754
Immediate Actions Required
- Restrict formula field creation and modification permissions to trusted administrators until a patched release is deployed.
- Review all existing formula fields for index() invocations that pass a fourth argument and remove or rewrite them.
- Rotate any secrets that may be reachable from the Baserow PostgreSQL role and audit the database for unauthorized changes.
Patch Information
No fixed version is listed in the NVD entry at publication time. Monitor the GitHub Baserow Repository and vendor release notes for a security update addressing CVE-2026-19754, and apply it as soon as it becomes available.
Workarounds
- Remove the ability for low-privileged roles to create or edit formula fields through Baserow's role and permission settings.
- Run Baserow against a PostgreSQL role scoped strictly to the Baserow schema and deny access to unrelated databases and system catalogs.
- Place Baserow behind a web application firewall or reverse proxy that inspects and blocks formula payloads containing SQL metacharacters in the fourth argument of index().
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
