SQL Injection Vulnerability in Budibase Server Affecting MySQL and MSSQL Databases

CVE-2026-100683

What is CVE-2026-100683?

Budibase Server prior to version 3.45.0 contains a vulnerability that allows an attacker with DDL rights on a connected MySQL or MSSQL database to exploit improper handling of column renames. By injecting malicious SQL through column names that include backticks (for MySQL) or single quotes (for MSSQL), an attacker can manipulate the schema introspection feature to execute unauthorized commands. This vulnerability leverages the multi-statement capabilities of the MySQL connection, permitting destructive actions on the database, bypassing normal permissions and safeguards. It is critical for users to update to version 3.45.0 to protect against this threat.

References