Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-35216 · Microsoft / collected KEV context

EUVD-2026-18795

GHSA-fcm4-4pj2-m5hf

cve-program · CVE-2026-35216

• https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf
• https://github.com/Budibase/budibase/pull/18238
• https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256
• https://github.com/Budibase/budibase/releases/tag/3.33.4

euvd · EUVD-2026-18795

• https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf
• https://github.com/Budibase/budibase/pull/18238
• https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256
• https://github.com/Budibase/budibase/releases/tag/3.33.4

nvd · CVE-2026-35216

• https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256
• https://github.com/Budibase/budibase/pull/18238
• https://github.com/Budibase/budibase/releases/tag/3.33.4
• https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf

osv · GHSA-fcm4-4pj2-m5hf

• https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf
• https://nvd.nist.gov/vuln/detail/CVE-2026-35216
• https://github.com/Budibase/budibase/pull/18238
• https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256
• https://github.com/Budibase/budibase
• https://github.com/Budibase/budibase/releases/tag/3.33.4

No related operational record is retained in the current change model.