CVE-2026-54351: Budibase Low-Code Platform RCE Vulnerability

CVE-2026-54351 Overview

Budibase is an open-source low-code platform used to build internal tools and applications. CVE-2026-54351 is a mass assignment vulnerability in the webhook trigger endpoint that lets attackers overwrite the internal appId property by injecting it into the webhook POST body. The externalTrigger() function passes the full HTTP request body into automation execution parameters without filtering internal fields. When automations execute asynchronously, the worker runs the attacker-controlled automation in the victim workspace context. This grants full read and write access to the victim's database. The flaw is fixed in Budibase 3.39.9.

Critical Impact
An unauthenticated network attacker can pivot into any Budibase workspace and read or modify its underlying database through crafted webhook requests.

Affected Products

Budibase versions prior to 3.39.9
Self-hosted Budibase deployments exposing webhook endpoints
Budibase automation worker components processing webhook triggers

Discovery Timeline

2026-06-26 - CVE-2026-54351 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-54351

Vulnerability Analysis

The vulnerability [CWE-915] arises in the webhook trigger endpoint, which is publicly accessible without authentication. Budibase forwards the entire HTTP request body into automation execution parameters. Because no allowlist is applied to incoming fields, an attacker can inject the internal appId parameter alongside legitimate webhook data. The automation engine then treats the injected appId as authoritative context for execution.

Webhooks without a collect step follow the default asynchronous path. The background worker dequeues the automation job and executes it against the workspace identified by the attacker-supplied appId. This effectively lets any external caller execute automations in the context of arbitrary tenants.

Root Cause

The root cause is unrestricted property assignment inside the externalTrigger() function. Budibase merges untrusted request body fields directly into the internal automation parameter object. There is no separation between user-controlled webhook payload data and privileged internal fields such as appId, allowing the attacker to overwrite trust boundaries.

Attack Vector

An attacker sends a crafted HTTP POST request to a Budibase webhook trigger URL and includes an appId field in the JSON body corresponding to a victim workspace. The worker processes the automation asynchronously in that workspace context. The attacker can then invoke automation steps that read, modify, or exfiltrate records from the victim's tables and data sources.

Code examples are not published for this issue. Refer to the Budibase GHSA-rgvg-3wpc-h44p advisory for vendor-provided technical details.

Detection Methods for CVE-2026-54351

Indicators of Compromise

Webhook POST requests containing an appId field in the JSON body that does not match the webhook's owning application.
Automation execution logs referencing workspaces that did not initiate the corresponding webhook.
Unexpected database read or write operations correlated with webhook trigger activity.

Detection Strategies

Inspect reverse proxy and application logs for requests to /api/webhooks/trigger/* containing internal parameter names such as appId in the body.
Correlate webhook trigger events with subsequent automation runs whose target workspace differs from the webhook's registered application.
Alert on automations executing against workspaces immediately after external webhook invocations from previously unseen source addresses.

Monitoring Recommendations

Enable verbose automation and worker logging in Budibase to capture the resolved appId for every execution.
Forward Budibase application, worker, and proxy logs to a central SIEM for cross-tenant anomaly analysis.
Baseline normal webhook payload schemas and alert on payloads containing reserved internal keys.

How to Mitigate CVE-2026-54351

Immediate Actions Required

Upgrade all Budibase instances to version 3.39.9 or later without delay.
Rotate any credentials, API keys, and data source secrets that may have been exposed to unauthorized automation execution.
Audit automation run history and database change logs for unauthorized activity since webhooks were enabled.

Patch Information

Budibase resolved the mass assignment flaw in version 3.39.9 by filtering internal parameters, including appId, from webhook request bodies before they reach externalTrigger(). Review the Budibase GitHub Security Advisory GHSA-rgvg-3wpc-h44p for full remediation guidance.

Workarounds

Restrict network access to webhook endpoints using a reverse proxy allowlist until the upgrade is applied.
Disable unused webhook-triggered automations to reduce the attack surface.
Apply a request body filter at the proxy layer that strips reserved keys such as appId from inbound webhook JSON payloads.

bash

# Example NGINX-level mitigation: block requests containing appId in webhook bodies
location /api/webhooks/trigger/ {
    if ($request_body ~* "\"appId\"") {
        return 400;
    }
    proxy_pass http://budibase_upstream;
}