CVE-2026-64657: Budibase PostgreSQL Connector SQLi Flaw

CVE-2026-64657 Overview

CVE-2026-64657 is a SQL injection vulnerability [CWE-89] in Budibase, an open-source low-code platform. The flaw exists in the PostgreSQL datasource connector at packages/server/src/integrations/postgres.ts, where the user-controlled schema configuration field is interpolated into a SET search_path statement without escaping embedded double quotes. An authenticated administrator who saves or tests the datasource can execute arbitrary SQL through the PostgreSQL simple query protocol. The issue is fixed in Budibase version 3.39.19.

Critical Impact
Authenticated administrators can execute arbitrary SQL statements against the connected PostgreSQL backend by injecting into the schema configuration field, resulting in confidentiality, integrity, and availability impact on the database.

Affected Products

Budibase open-source low-code platform
Budibase versions prior to 3.39.19
Deployments using the PostgreSQL datasource connector

Discovery Timeline

2026-08-17 - CVE-2026-64657 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-64657

Vulnerability Analysis

Budibase allows administrators to configure external datasources, including PostgreSQL. When a PostgreSQL datasource is created or tested, Budibase issues a SET search_path statement to scope subsequent queries to the configured schema. The connector concatenated the user-supplied schema string directly into that statement without sanitizing embedded double-quote characters. Because SET search_path is dispatched through PostgreSQL's simple query protocol, an attacker can terminate the quoted identifier, append a semicolon, and follow with arbitrary SQL executed in the same session.

The impact extends beyond schema resolution. Injected statements run with the privileges of the database role Budibase uses to connect, which is typically a highly privileged account for schema introspection. Attackers can exfiltrate data, modify records, create roles, or invoke server-side functions supported by the database.

Root Cause

The root cause is missing identifier quoting when building the SET search_path statement. The patch introduces a quotePostgresIdentifier helper imported from ./utils and applies it to the schema value before concatenation, ensuring embedded double quotes are properly escaped.

Attack Vector

Exploitation requires an authenticated Budibase user with administrator privileges to save or test a PostgreSQL datasource. The attacker supplies a crafted schema value containing a double-quote character followed by injected SQL. When Budibase constructs the SET search_path command, the attacker-controlled payload closes the identifier and executes as additional statements in the simple query protocol batch.

typescript

// Patch excerpt from packages/server/src/integrations/postgres.ts
   finaliseExternalTables,
   checkExternalTables,
   HOST_ADDRESS,
+  quotePostgresIdentifier,
 } from "./utils"
 import { PostgresColumn } from "./base/types"
 import { escapeDangerousCharacters } from "../utilities"

The fix imports quotePostgresIdentifier and applies safe identifier quoting to the schema value before it reaches the query builder. Source: GitHub Commit 67572a82

Detection Methods for CVE-2026-64657

Indicators of Compromise

PostgreSQL server logs showing multi-statement queries originating from the Budibase service account, especially statements chained after SET search_path.
Datasource configuration entries with schema field values containing double-quote characters, semicolons, or SQL keywords.
Unexpected creation of database roles, functions, or extensions immediately after a Budibase datasource save or test event.

Detection Strategies

Audit Budibase application logs for datasource save and datasource test events, correlating operator identity with the submitted schema value.
Enable PostgreSQL log_statement = 'all' on Budibase-connected instances during triage and search for anomalous statements following SET search_path.
Compare deployed Budibase versions against 3.39.19 using package inventory or container image scanning to identify vulnerable instances.

Monitoring Recommendations

Alert on new or modified PostgreSQL datasources within Budibase and require review of the schema configuration field.
Monitor privileged database role activity attributed to the Budibase connection account for statements outside expected read patterns.
Track outbound queries from the Budibase server for anomalous SQL volume or unexpected use of administrative commands such as CREATE ROLE or COPY.

How to Mitigate CVE-2026-64657

Immediate Actions Required

Upgrade Budibase to version 3.39.19 or later on all self-hosted and managed deployments.
Rotate credentials for any PostgreSQL account used by Budibase datasources after patching.
Review the administrator user roster in Budibase and remove accounts that do not require datasource configuration privileges.

Patch Information

The vulnerability is fixed in Budibase 3.39.19. The patch adds identifier quoting for schema values in the PostgreSQL connector. Review the GitHub Security Advisory GHSA-qqf5-x7mj-v43p and the GitHub Commit 67572a82 for the full change set.

Workarounds

Restrict Budibase administrator access to trusted operators until the upgrade is applied.
Configure PostgreSQL datasource accounts with the least privilege required, avoiding superuser or database owner roles.
Deploy network controls that prevent the Budibase service from reaching PostgreSQL databases hosting sensitive data until patched.

bash

# Upgrade Budibase self-hosted deployment via Docker Compose
docker compose pull
docker compose up -d

# Verify installed version
docker exec budibase-apps node -e "console.log(require('./package.json').version)"