Budibase 3.45.0 Fixes Six Security Flaws
Budibase 3.45.0 patches six CVEs including arbitrary file write (CVSS 8.8), SSO auth bypass (8.1), and SQL injection (8.0). Update now if Builder is exposed.
Marisol "Fuse" DelgadoBudibase shipped version 3.45.0 on September 26, 2026, patching six CVEs. Three are high severity. Here is what to do with them.
Patch this first
If your instance exposes the Builder workspace to multiple users or to the internet, update to 3.45.0 today.
CVE-2026-100682 (CVSS 8.8, high) is an arbitrary file write in the PWA icon upload endpoint, reachable by any user with Builder access. The root cause is a missing symlink check during ZIP extraction. On a self-hosted deployment, the reachable filesystem scope includes application configuration files.
CVE-2026-100684 (CVSS 8.1, high) is an authentication bypass in the OIDC/SSO login path, present in versions 3.41.0 through 3.44.x. When the platform receives an SSO subject it does not recognize, it creates a new user account rather than rejecting the login. Instances using external identity providers are at highest risk.
Both have low access bars relative to their severity. Treat them as priority patches.
Also patched
CVE-2026-100683 (CVSS 8.0, high) is a SQL injection in the MySQL and MSSQL column-rename path. Identifiers are interpolated directly into DDL statements without parameterization. Users with schema-edit access on MySQL or MSSQL datasources are affected. PostgreSQL is not.
Three medium-severity issues round out the release. CVE-2026-100688 (CVSS 6.5) is a cross-tenant information disclosure in the application package API. CVE-2026-100681 (CVSS 5.4) is a server-side request forgery in the Microsoft Teams webhook integration. CVE-2026-100687 (CVSS 5.5) leaks plaintext datasource credentials to all connected Builder clients over the collaboration WebSocket.
None of the six appear in the CISA Known Exploited Vulnerabilities catalog, and the advisories note no active exploitation at disclosure. Version 3.45.0 addresses all six.
Related coverage
- [ HIGH ]CVE-2026-100682Budibase arbitrary file write via ZIP symlink in PWA icon upload
- [ HIGH ]CVE-2026-100684Budibase SSO authentication bypass creates unauthorized user accounts
- [ HIGH ]CVE-2026-100683Budibase SQL injection in MySQL and MSSQL column-rename DDL
Found this useful? Share it.
