Budibase SQL injection in MySQL and MSSQL column-rename DDL
Budibase before 3.45.0 interpolates column identifiers directly into ALTER TABLE rename statements for MySQL and MSSQL, enabling SQL injection by users with schema-edit access.
- Vendor
- Budibase
- Product
- Budibase Server (versions before 3.45.0)
- CVSS
- 8.0
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
Is CVE-2026-100683 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-100683 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-100683 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Budibase Server before 3.45.0 builds MySQL and MSSQL column-rename DDL by interpolating column identifiers directly into raw query strings using backtick quoting in packages/backend-core/src/sql/sqlTable.ts. A user with schema-edit permissions can supply a column name containing SQL metacharacters that break out of the backtick context and inject arbitrary SQL into the resulting ALTER TABLE ... RENAME COLUMN statement.
The issue is present in the MySQL and MSSQL code paths. PostgreSQL uses a different quoting approach and is not reported as affected. Budibase 3.45.0 addresses the flaw by using parameterized identifiers for column names in rename operations. Instances that do not connect to MySQL or MSSQL datasources are not affected.
The advisory notes no evidence of active exploitation. This CVE is not listed in the CISA KEV catalog at publication.
Other Budibase CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-100684 Budibase SSO authentication bypass creates unauthorized user accountswrite-up | [ HIGH ] | 8.1 | 0.4% | — |
| CVE-2026-100682 Budibase arbitrary file write via ZIP symlink in PWA icon uploadwrite-up | [ HIGH ] | 8.8 | 0.7% | — |
