CVE-2026-54356: Budibase S3 Authentication Bypass Vulnerability

CVE-2026-54356 Overview

CVE-2026-54356 is a missing authorization vulnerability [CWE-862] in Budibase, an open-source low-code platform. Versions prior to 3.41.3 expose the POST /api/attachments/:datasourceId/url endpoint to authenticated published-app users holding only the BASIC role. Attackers can supply arbitrary bucket and key parameters and receive signedUrl and publicUrl values generated with stored S3 datasource credentials. The flaw enables abuse of server-side S3 access to interact with buckets outside the intended application scope. Budibase resolved the issue in version 3.41.3.

Critical Impact
Low-privileged authenticated users can leverage stored S3 credentials to generate signed URLs against attacker-chosen buckets and keys, undermining data integrity boundaries.

Affected Products

Budibase versions prior to 3.41.3
packages/server/src/api/routes/static.ts
packages/server/src/api/controllers/static/index.ts

Discovery Timeline

2026-08-17 - CVE-2026-54356 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-54356

Vulnerability Analysis

The vulnerability resides in Budibase's attachment URL endpoint. The route POST /api/attachments/:datasourceId/url accepts a datasourceId path parameter and body values that specify the target S3 bucket and object key. The handler uses stored datasource credentials to produce a signed URL and a public URL for the requested object. The endpoint does not verify that the requesting user is authorized to control the bucket and key values. Any authenticated user of a published Budibase application holding the BASIC role can invoke it. This turns a server-side integration primitive into a user-controllable S3 URL generator.

Root Cause

The root cause is missing authorization on a privileged server operation [CWE-862]. The controller trusts attacker-supplied bucket and key parameters and applies server-held S3 credentials to sign them. There is no scope check binding the request to the datasource's intended objects or to the caller's role permissions.

Attack Vector

An attacker first authenticates to a published Budibase application with a standard BASIC user account. The attacker then issues a crafted POST request to /api/attachments/:datasourceId/url supplying a bucket name and object key of their choice. Budibase responds with signedUrl and publicUrl values backed by the stored datasource credentials. The attacker can use these URLs to write, overwrite, or interact with objects reachable by the credentials, resulting in integrity impact on connected S3 storage. Full technical detail is available in the GitHub Security Advisory GHSA-6x9p-4r67-5gjx.

Detection Methods for CVE-2026-54356

Indicators of Compromise

Unexpected POST requests to /api/attachments/:datasourceId/url originating from BASIC-role app users.
Signed URL requests containing bucket or key values that do not match the datasource's configured object prefix.
S3 CloudTrail events showing PutObject or GetObject activity against buckets outside the application's normal scope, initiated with the Budibase datasource credentials.

Detection Strategies

Enable HTTP access logging on Budibase and alert on requests to the attachment URL route from non-administrative sessions.
Correlate Budibase application audit logs with S3 API access logs to identify signed URLs generated for unexpected bucket or key targets.
Baseline normal datasourceId, bucket, and key combinations, then flag deviations.

Monitoring Recommendations

Forward Budibase server logs and cloud storage audit logs into a centralized analytics tier for cross-source correlation.
Monitor S3 bucket policies and datasource credentials for unexpected use patterns outside application working hours.
Track user role assignments and alert when BASIC-role accounts generate high volumes of attachment URL requests.

How to Mitigate CVE-2026-54356

Immediate Actions Required

Upgrade Budibase to version 3.41.3 or later without delay.
Rotate any S3 access keys configured as Budibase datasources if the vulnerable version was exposed to untrusted users.
Audit S3 bucket contents and access logs for unauthorized modifications during the exposure window.

Patch Information

The fix is included in Budibase 3.41.3. Release notes are published at the GitHub Release 3.41.3 page, and the coordinated disclosure details appear in the GitHub Security Advisory GHSA-6x9p-4r67-5gjx. Upgrade both self-hosted and container-based deployments and restart affected services.

Workarounds

Restrict published-app access to trusted users until the upgrade is applied.
Scope S3 datasource IAM credentials to the minimum bucket and prefix required by the application.
Disable or firewall the /api/attachments/:datasourceId/url route at a reverse proxy when patching is delayed.

bash

# Example IAM policy restricting Budibase datasource credentials to a single prefix
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::budibase-app-bucket/attachments/*"
    }
  ]
}