Critical Unauthenticated SQL Injection in Budibase Allows Snowflake Compromise

Overview

CVE-2026-72851 is a CVSS 10.0 SQL injection vulnerability in Budibase versions before 3.40.0 that enables unauthenticated attackers to execute arbitrary SQL commands on connected databases like Snowflake through crafted webhook requests. Exploitation can bypass authentication and leverage builder credentials to exfiltrate, modify, or persist in enterprise data systems.

Technical Analysis

Budibase's webhook endpoints with EXECUTE_QUERY steps fail to sanitize input in payloads, allowing attackers to inject malicious SQL code. Attackers can POST malicious JSON to /api/webhooks/trigger/<webhook-id> endpoints, executing queries with builder-privileged database credentials. This vulnerability is trivially exploitable via standard HTTP requests without authentication, targeting widely-used databases including Snowflake to achieve persistence or data theft.

Enterprise & DIB Impact

Defense Industrial Base (DIB) organizations relying on Budibase integrations with Snowflake or other database platforms are at critical risk of credential theft, sensitive data exposure, and compliance violations. State-sponsored or cybercriminal actors could exploit this flaw to infiltrate secure enterprise data lakes, industrial control systems, or classified research repositories.

Recommended Actions

• Upgrade to Budibase 3.40.0 immediately
• validate all webhook automation configurations to remove unnecessary EXECUTE_QUERY steps
• implement input sanitization for webhook payloads
• enable monitoring for anomalous database query patterns
• and enforce least-privilege database access for builder credentials.