CVE-2026-100680
High
Description
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.
SeverityHigh
CVSS8.1
Exploit probability—
ProductBudibase Server
PublishedSep 26, 2026
First seenSep 26, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- budibase server3.45.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| budibase server | v < 3.45.0 | 3.45.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.