CVE-2026-73300: Budibase MySQL SQL Injection Vulnerability

CVE-2026-73300 Overview

CVE-2026-73300 is a SQL injection vulnerability [CWE-89] in Budibase, an open-source low-code platform for building internal tools and applications. The flaw exists in the MySQL integration component, which is configured with multipleStatements: true. This setting permits execution of multiple SQL statements within a single query. Attackers can inject malicious SQL commands through user input fields to compromise the backing MySQL database. The vulnerability affects all Budibase versions prior to 3.40.0 and is fixed in release 3.40.0.

Critical Impact
Successful exploitation grants attackers the ability to read, modify, or destroy database contents and chain multiple SQL statements in a single request, leading to full database compromise.

Affected Products

Budibase versions prior to 3.40.0
Budibase deployments using the MySQL data source integration
Self-hosted and cloud Budibase instances exposing user-facing forms bound to MySQL queries

Discovery Timeline

2026-08-12 - CVE-2026-73300 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73300

Vulnerability Analysis

Budibase provides a MySQL data source connector that lets low-code applications execute parameterized queries against MySQL backends. The connector initializes the underlying mysql client with the multipleStatements: true option enabled. This option instructs the driver to accept and execute several semicolon-separated statements per query call.

When user-supplied input is concatenated into a query without strict validation or parameter binding, an attacker can terminate the intended statement and append arbitrary follow-on SQL. Because the driver accepts stacked queries, the attacker is not limited to modifying the original statement. They can execute additional INSERT, UPDATE, DELETE, DROP, or privilege manipulation statements in the same request.

Exploitation only requires access to a Budibase-hosted form or endpoint that submits data to a MySQL data source. The attack is remote and unauthenticated where such forms are publicly exposed.

Root Cause

The root cause is an insecure default in the MySQL integration: multipleStatements: true combined with query construction that permits untrusted input to influence statement structure. The multipleStatements flag is disabled by default in the upstream mysql Node.js driver precisely because it broadens the impact of any downstream injection flaw.

Attack Vector

The attack vector is network-based and requires user interaction, such as a victim loading a Budibase app that submits attacker-influenced input, or an attacker directly submitting crafted payloads through a form. Because Budibase applications commonly bind form fields to backend queries, any field feeding a MySQL query is a candidate injection sink. A payload of the form '; DROP TABLE users; -- submitted to a vulnerable field executes both the original statement and the injected DROP TABLE, illustrating the stacked-query risk enabled by multipleStatements: true.

See the GitHub Security Advisory GHSA-q6x4-v3qx-85qw for the vendor's technical description.

Detection Methods for CVE-2026-73300

Indicators of Compromise

MySQL general or audit logs showing multiple semicolon-separated statements originating from Budibase service accounts
Unexpected DROP, CREATE USER, GRANT, or INFORMATION_SCHEMA queries issued by the Budibase application user
Sudden schema changes, new administrative database users, or bulk row deletions correlated with Budibase request traffic
Web access logs showing form submissions containing SQL metacharacters such as ';, -- , UNION SELECT, or /*

Detection Strategies

Enable the MySQL general query log or audit plugin on databases connected to Budibase and alert on stacked statements from the Budibase user
Inspect Budibase application logs for query execution errors that indicate probing of injection points
Baseline the query patterns emitted by each Budibase data source and alert on deviations in verb, table, or statement count

Monitoring Recommendations

Forward MySQL audit logs and Budibase container logs to a centralized analytics platform for correlation
Monitor Budibase server versions across the estate and alert on any instance running a release earlier than 3.40.0
Track outbound connections from Budibase pods or hosts for unexpected data egress that may indicate exfiltration following successful injection

How to Mitigate CVE-2026-73300

Immediate Actions Required

Upgrade all Budibase instances to version 3.40.0 or later, which disables multipleStatements and hardens query handling
Rotate MySQL credentials used by Budibase data sources after patching, in case they were exposed prior to upgrade
Review MySQL user grants and remove any unexpected accounts, privileges, or schema objects created since the vulnerable version was deployed
Audit Budibase applications for form fields bound directly to raw SQL queries and refactor them to use parameterized bindings

Patch Information

The fix is included in Budibase Release 3.40.0. The release removes the multipleStatements: true configuration from the MySQL integration, preventing stacked-query execution even when injection primitives exist. Administrators should also review the GitHub Security Advisory GHSA-q6x4-v3qx-85qw for upgrade guidance.

Workarounds

Restrict the MySQL account used by Budibase to the minimum required privileges, denying DROP, CREATE USER, GRANT, and FILE where possible
Place a web application firewall in front of Budibase and block requests containing stacked SQL syntax such as ;--, ; DROP, or ; INSERT
Limit network exposure of Budibase apps that bind to MySQL data sources to authenticated internal users until the patch is applied

bash

# Verify the running Budibase version and upgrade via Docker Compose
docker exec budibase-app cat /app/package.json | grep '"version"'

# Pull and deploy the patched release
docker compose pull
docker compose up -d

# Confirm the upgraded version is 3.40.0 or later
docker exec budibase-app cat /app/package.json | grep '"version"'