CVE-2026-35216
published 2026-04-03CVE-2026-35216: Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase…
PriorityP277critical9CVSS 3.1
AVNACHPRNUINSCCHIHAH
EPSS
11.98%
95.6th percentile
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| budibase | budibase | < 3.33.4 | 3.33.4 |
| budibase | server | >= 0 < 3.33.4 | 3.33.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
osv·2026-04-04
CVE-2026-35216 [CRITICAL] Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
### Summary
An unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as `root` inside the container.
### Details
**Vulnerable endpoint — `packages/server/src/api/routes/webhook.ts` line 13:**
```typescript
// this shouldn't have authorisation, right now its always public
publicRoutes.post("/api/webhooks/trigger/:instance/:id", controller.trigger)
```
The webhook trigger endpoint is registered on `publicRoutes` with **no authentication
middleware**. Any unauthenticated HTTP client can POST to this endp
GHSA
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
ghsa·2026-04-04
CVE-2026-35216 [CRITICAL] CWE-78 Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
### Summary
An unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as `root` inside the container.
### Details
**Vulnerable endpoint — `packages/server/src/api/routes/webhook.ts` line 13:**
```typescript
// this shouldn't have authorisation, right now its always public
publicRoutes.post("/api/webhooks/trigger/:instance/:id", controller.trigger)
```
The webhook trigger endpoint is registered on `publicRoutes` with **no authentication
middleware**. Any unauthenticated HTTP client can POST to this endp
No detection rules found.
No public exploits indexed.
https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256https://github.com/Budibase/budibase/pull/18238https://github.com/Budibase/budibase/releases/tag/3.33.4https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hfhttps://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf
2026-04-03
Published