CVE-2026-73409: Budibase Information Disclosure Flaw

CVE-2026-73409 Overview

CVE-2026-73409 is a medium-severity information disclosure vulnerability in Budibase, an open-source low-code platform. Versions prior to 3.40.1 passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to the MongoClient constructor on Budibase Cloud. A builder with datasource privileges could submit absolute server paths through the /api/datasources/verify endpoint and infer file existence and readability on the shared cloud server by comparing MongoDB driver error responses. The vulnerability is classified under [CWE-203: Observable Discrepancy]. The issue is fixed in version 3.40.1.

Critical Impact
Authenticated builders on Budibase Cloud can enumerate the presence and readability of arbitrary filesystem paths, exposing internal file layout on shared infrastructure.

Affected Products

Budibase versions prior to 3.40.1
Budibase Cloud (multi-tenant hosted deployments)
packages/server/src/integrations/mongodb.ts component

Discovery Timeline

2026-08-12 - CVE-2026-73409 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73409

Vulnerability Analysis

The vulnerability resides in the MongoDB integration handler at packages/server/src/integrations/mongodb.ts. When a builder configured a MongoDB datasource, the server forwarded the tlsCertificateKeyFile and tlsCAFile configuration fields unmodified to the MongoClient constructor. On Budibase Cloud, this behavior was inappropriate because builders share underlying server infrastructure and should not access local files.

The /api/datasources/verify endpoint invoked a connection attempt using the builder-supplied paths. The MongoDB Node.js driver returned distinguishable errors when a file was missing, unreadable, or present but invalid as a certificate. An attacker could compare these error messages to build an oracle for filesystem enumeration.

Root Cause

The root cause is missing environment-aware input validation. The integration code did not distinguish between self-hosted deployments, where local file paths are legitimate, and multi-tenant cloud deployments, where builder-supplied filesystem paths must be rejected. This led to a discrepancy-based information leak [CWE-203].

Attack Vector

An authenticated builder submits a crafted MongoDB datasource configuration to /api/datasources/verify with tlsCertificateKeyFile or tlsCAFile set to an absolute path such as /etc/shadow or /root/.ssh/id_rsa. The attacker records the driver error and repeats the request with different target paths, comparing responses to determine which files exist and are readable by the Budibase process.

typescript

// Security patch in packages/server/src/integrations/mongodb.ts
export function buildMongoClientOptions(
  config: MongoDBConfig,
  selfHosted = !!environment.SELF_HOSTED
): MongoClientOptions {
  return selfHosted
    ? {
        tlsCertificateKeyFile: config.tlsCertificateKeyFile || undefined,
        tlsCAFile: config.tlsCAFile || undefined,
      }
    : {}
}

export class MongoIntegration implements IntegrationBase {
  private config: MongoDBConfig
  private client: MongoClient

  constructor(config: MongoDBConfig) {
    this.config = config
    const options = buildMongoClientOptions(config)
    this.client = new MongoClient(config.connectionString, options)
  }
}

Source: GitHub Commit e58aa31. The patch gates TLS file path forwarding behind the SELF_HOSTED environment flag, discarding these fields on Budibase Cloud.

Detection Methods for CVE-2026-73409

Indicators of Compromise

Repeated POST requests to /api/datasources/verify from a single builder account with varying tlsCertificateKeyFile or tlsCAFile values.
MongoDB datasource verification attempts containing absolute filesystem paths such as /etc/, /root/, or /proc/ in TLS file fields.
Elevated volumes of failed MongoDB connection attempts originating from the Budibase server process.

Detection Strategies

Inspect application logs for /api/datasources/verify payloads referencing filesystem paths in tlsCertificateKeyFile or tlsCAFile fields.
Correlate MongoDB driver error events with builder account activity to identify enumeration patterns.
Alert on any datasource verification request submitting paths outside expected certificate storage directories.

Monitoring Recommendations

Enable audit logging for all datasource create, update, and verify operations, capturing the submitting user and full request body.
Monitor the Budibase server process for unusual file access patterns targeting sensitive paths.
Track error rates from the MongoDB integration and flag statistical anomalies suggesting oracle probing.

How to Mitigate CVE-2026-73409

Immediate Actions Required

Upgrade Budibase to version 3.40.1 or later on all cloud and multi-tenant deployments.
Review audit logs for suspicious /api/datasources/verify activity referencing absolute filesystem paths.
Rotate any credentials, keys, or secrets stored in filesystem locations that may have been enumerated.

Patch Information

The fix is available in Budibase Release 3.40.1. The patch introduces the buildMongoClientOptions function, which forwards TLS file paths only when the SELF_HOSTED environment variable is set. Details are published in GitHub Security Advisory GHSA-ppr4-5f46-j9c6 and Pull Request 19244.

Workarounds

Restrict builder role assignment to trusted users until the upgrade is applied.
Deploy a reverse proxy rule that rejects datasource verification requests containing absolute paths in TLS-related fields.
Run the Budibase server process under a least-privilege account with no read access to sensitive host files.

bash

# Verify installed Budibase version and upgrade
docker pull budibase/budibase:3.40.1
docker stop budibase && docker rm budibase
docker run -d --name budibase \
  -e SELF_HOSTED=1 \
  -p 10000:80 \
  budibase/budibase:3.40.1