{"id":"CVE-2026-35216","sourceIdentifier":"security-advisories@github.com","published":"2026-04-03T16:16:41.800","lastModified":"2026-10-06T22:10:00.247","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4."},{"lang":"es","value":"Budibase es una plataforma de código abierto de bajo código. Antes de la versión 3.33.4, un atacante no autenticado puede lograr la Ejecución Remota de Código (RCE) en el servidor de Budibase al activar una automatización que contiene un paso Bash a través del endpoint público de webhook. No se requiere autenticación para activar el exploit. El proceso se ejecuta como root dentro del contenedor. Este problema ha sido parcheado en la versión 3.33.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Budibase","product":"budibase","versions":[{"version":"< 3.33.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-03T16:46:19.884852Z","id":"CVE-2026-35216","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*","versionEndExcluding":"3.33.4","matchCriteriaId":"B316A29C-7C2F-4102-ACF6-DDB06B3D0AD5"}]}]}],"references":[{"url":"https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/Budibase/budibase/pull/18238","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/Budibase/budibase/releases/tag/3.33.4","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}