VULNERABILITY INTELLIGENCE
CVE-2026-35216
CVSS score9 CRITICAL
EPSS probability10.90%
CISA KEVNot currently listed
Published2026-04-03
Last modified2026-10-06
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
Weakness classification
- security-advisories@github.com: CWE-78
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Issue Tracking, Patch
- security-advisories@github.com — Product, Release Notes
- security-advisories@github.com — Exploit, Vendor Advisory
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory