CVE-2026-72857CWE-522

CVE-2026-72857

High · published August 14, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-08-14T02:17Z
References (3)
https://github.com/Budibase/budibase/security/advisories/GHSA-6mpp-gfg5-x2vv · [email protected]https://www.vulncheck.com/advisories/budibase-before-credential-exposure-via-string-fields · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-6mpp-gfg5-x2vv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 21:54Z
    Budibase before 3.40.0 Credential Exposure via STRING Fields
    cvelistv5