Credential Exposure in Budibase Affects MongoDB and Firebase Configurations

CVE-2026-72857

What is CVE-2026-72857?

Budibase, prior to version 3.40.0, exhibits a vulnerability that fails to properly redact datasource credentials, specifically within STRING typed fields. This oversight enables authenticated users with table read permissions to access sensitive MongoDB connection strings and Firebase private keys in plaintext. Attackers can exploit this vulnerability through the read API, allowing them to retrieve sensitive datasource configurations, including live backend database credentials and service account keys, potentially compromising the integrity of the entire system.

References