CVE-2026-100687CWE-200information-disclosure

CVE-2026-100687

Medium · published September 26, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
7.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00256 · 16.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-26T18:16Z
References (2)
https://github.com/Budibase/budibase/security/advisories/GHSA-rmv5-3xpj-w885 · [email protected]https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-credential-exposure-via-external-table-broadcast · [email protected]
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 26 SEP 13:23Z
    Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
    cvelistv5