CVE-2026-72853

High

Description

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.

SeverityHigh

CVSS7.6

Exploit probability—

ProductBudibase

PublishedAug 13, 2026

First seenAug 13, 2026

Weakness typeCWE-89SQL injection

How to fix

Update

Budibase budibase3.40.0 or later

Vendor advisories

github.com/Budibase/budibase/security/advisories/GHSA-xj29-x47g-9w2c

Affected products

Product	Affected versions	Fixed in
Budibase budibase	v < 3.40.0	3.40.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.