CVE-2026-54350 – Unauthenticated NoSQL Operator Injection – Budibase prior to 3.39.12

Summary

CVE-2026-54350 is a critical unauthenticated NoSQL operator injection vulnerability in Budibase, the open-source low-code platform, affecting all versions prior to 3.39.12. By injecting JSON metacharacters into published-app query parameters, an unauthenticated attacker can override the builder-defined database filter and read or overwrite every document in the backing collection with a single HTTP request. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).

Technical details

• Root cause: The enrichContext function (packages/server/src/sdk/workspace/queries/queries.ts:121–138) substitutes attacker-controlled parameter values directly into the raw JSON body of a query before calling JSON.parse(). The input validator validateQueryInputs (packages/server/src/api/controllers/query/index.ts:61–71) only rejects Handlebars markers ({{, }}) and does not escape JSON metacharacters (", “, }).
• Injection mechanism: A parameter value containing a closing quote and additional keys lifts attacker-controlled fields into the parsed filter object. For MongoDB find queries, duplicate-key JSON parsing causes the attacker’s key (e.g., {"$exists": true}) to override the builder’s intended filter, returning every document in the collection. The same primitive against a published updateMany query widens the filter scope to the full collection.
• Authentication bypass: The authorized middleware (packages/server/src/middleware/authorized.ts:141–148) short-circuits all authentication and CSRF checks when a query’s role is set to PUBLIC. The endpoint POST /api/v2/queries/:queryId requires no session — only the x-budibase-app-id header, which is publicly visible in any published-app URL.
• Affected datasources: MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, and REST datasources with a JSON body. SQL-backed datasources (PostgreSQL, MySQL, MSSQL, Oracle, MariaDB) are not affected, as they use bind-parameterised interpolation.
• Impact: Full mass data read (Confidentiality: HIGH) and mass data write/overwrite (Integrity: HIGH) across all vulnerable datasources. Scope is Changed, as the injected query crosses the security boundary into the backing database.

Affected software

• @budibase/server (npm): all versions prior to 3.39.12

Severity

| Metric | Value |
|—|—|
| CVSS v3.1 Base Score | 10.0 (Critical) |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Scope | Changed |

Mitigation and recommended actions

• Immediate action – patch: Upgrade @budibase/server to version 3.39.12 or later, which contains the vendor-provided fix.
• If immediate patching is not possible:
  • Restrict public internet access to all Budibase instances via firewall or network policy.
  • Audit published applications and temporarily revoke the PUBLIC role from any non-SQL queries (MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, REST-with-JSON-body) until the patch is applied.
  • Treat all data in collections backing PUBLIC queries as potentially compromised pending a security review.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-54350 at NIST
• Budibase Security Advisory GHSA-8qv3-p479-cj62