CVE-2026-82244: Budibase Plugin RCE Vulnerability

CVE-2026-82244 Overview

CVE-2026-82244 is a remote code execution vulnerability in Budibase versions before 3.41.3. The flaw resides in the plugin handling subsystem, where the server calls eval() on plugin JavaScript files without sandboxing. Authenticated admin users can upload a malicious plugin tarball and execute arbitrary code in the main Node.js process. In default deployments, the process runs with root privileges, allowing attackers to exfiltrate environment variables, credentials, and secrets. The Common Weakness Enumeration classifies this issue under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated admin attackers achieve full remote code execution in the Budibase Node.js process, typically with root privileges, exposing environment secrets and enabling host compromise.

Affected Products

Budibase versions prior to 3.41.3
Self-hosted Budibase deployments running with default root privileges
Budibase instances exposing the plugin upload feature to admin accounts

Discovery Timeline

2026-08-28 - CVE-2026-82244 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82244

Vulnerability Analysis

Budibase supports server-side plugins packaged as tarball archives. When an admin uploads a plugin, the server extracts the archive and processes the included JavaScript files. The plugin loader passes the JavaScript source directly to Node.js eval() without executing it inside a sandbox such as vm.Context or an isolated worker. Any code contained in the plugin runs in the main server process with full access to the runtime, filesystem, and network. Because the vulnerability requires an authenticated administrator account, exploitation depends on prior credential compromise, account takeover, or a malicious insider.

Root Cause

The root cause is unsafe dynamic code evaluation on attacker-controlled input. The plugin handler treats uploaded JavaScript as trusted code and invokes eval() in the main Node.js process. There is no schema validation, static analysis, permission scoping, or process isolation between the plugin and the Budibase server. This pattern maps directly to CWE-94: Improper Control of Generation of Code.

Attack Vector

An attacker with admin credentials crafts a plugin tarball containing a JavaScript file with arbitrary payload code. The attacker uploads the tarball through the Budibase plugin management interface. The server evaluates the payload in-process, granting the attacker code execution as the Budibase user. In containerized default deployments, this user is root, so the attacker gains full container control, reads mounted secrets, and pivots to connected databases and cloud APIs. Refer to the Budibase GitHub Security Advisory GHSA-gwr2-pgg3-p7xp and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-82244

Indicators of Compromise

Unexpected plugin tarball uploads recorded in Budibase admin audit logs, particularly from unfamiliar admin accounts or IP addresses.
Child processes spawned by the Budibase Node.js process, such as sh, bash, curl, wget, or nc, which are abnormal for the application baseline.
Outbound network connections from the Budibase host to unknown external endpoints shortly after a plugin upload event.
Access to environment files, /proc/self/environ, or cloud instance metadata endpoints from the Budibase process.

Detection Strategies

Alert on any write to the Budibase plugin directory that is not tied to an approved change ticket or CI/CD pipeline.
Correlate admin authentication events with subsequent plugin upload API calls to /api/plugin endpoints.
Baseline the Budibase Node.js process behavior and flag deviations such as new process ancestry or file access patterns.

Monitoring Recommendations

Enable and centralize Budibase application audit logs, including all administrative actions and plugin lifecycle events.
Monitor container runtime telemetry for process spawns, filesystem changes, and outbound connections originating from Budibase workloads.
Track admin account creation, role changes, and failed authentication attempts to detect credential-based precursors to exploitation.

How to Mitigate CVE-2026-82244

Immediate Actions Required

Upgrade all Budibase instances to version 3.41.3 or later without delay.
Rotate credentials, API keys, and secrets exposed to the Budibase runtime, including database passwords and cloud service tokens.
Review the admin user list, disable unused accounts, and enforce multi-factor authentication on all remaining admin accounts.
Audit the plugin directory and admin audit logs for any unauthorized plugin uploads since the deployment date.

Patch Information

Budibase resolved the vulnerability in release 3.41.3. The fix is documented in the Budibase GitHub Security Advisory GHSA-gwr2-pgg3-p7xp. Operators running self-hosted deployments should pull the patched container image or upgrade via their package manager and restart the service.

Workarounds

Restrict network access to the Budibase admin interface using an allowlist, VPN, or reverse proxy authentication until patching is complete.
Run the Budibase container as a non-root user with a read-only filesystem to reduce blast radius if exploitation occurs.
Remove or disable the plugin upload feature for admin roles if plugins are not required in the environment.
Isolate Budibase workloads on dedicated hosts or namespaces and apply egress filtering to block unexpected outbound traffic.

bash

# Configuration example: run Budibase as non-root with restricted egress
docker run -d \
  --user 1000:1000 \
  --read-only \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  -p 10000:10000 \
  budibase/budibase:3.41.3