CVE-2026-50137 is a critical (CVSS 9.4) missing authorization flaw in Budibase before 3.39.0. An anonymous caller who knows a workspace and S3 datasource id can get a short-lived signed upload URL minted with your stored AWS credentials. Upgrade to 3.39.0 and review the permissions of those keys.
What's affected
- Product: Budibase, the open source low-code platform, when an S3 datasource is configured.
- Affected: versions before 3.39.0.
- Fixed: 3.39.0, per the CVE record and the GitHub advisory.
- Weakness: CWE-862, missing authorization.
- CVSS 9.4 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. - Published 26 June 2026. Not marked as exploited in CISA KEV.
The advisory names the route that lacked an authorization check, which is the attachments endpoint that creates a signed upload URL for a datasource. It also says the bucket was caller-supplied rather than fixed to the datasource's configured bucket.
How to check if you're exposed
Find out which version you run and whether you use S3 datasources.
docker ps --format '{.Image}' | grep -i budibase
docker inspect --format '{.Config.Image}' <container>
In the Budibase builder, check your datasources for any that use Amazon S3. If you have none, the affected code path has nothing to sign with, though you should still upgrade.
Then look at the IAM policy attached to the access key each S3 datasource uses. The advisory says the attacker's reach is every bucket those credentials can write to, so the policy decides how bad the worst case is.
What to do now
- Upgrade Budibase to 3.39.0 or later and restart all instances.
- Review the IAM policy behind each S3 datasource and cut it down to the one bucket and the actions Budibase needs.
- Rotate the access keys used by S3 datasources if the instance was reachable from the internet while on an affected version.
- Check S3 access logs and CloudTrail for writes to buckets or keys that you do not expect, for the exposure window.
- Put the instance behind your normal access controls so it is not open to anonymous traffic by default.
Why it matters
The core mistake is simple. The route that creates a signed upload URL had a bot check but no authorization check, so it ran for anyone. It then used the stored AWS keys to sign a URL for a bucket the caller picked. The advisory notes the effect: the signed URL is valid for 15 minutes and is made with the victim's identity, so the write is allowed by AWS.
This is CWE-862. Two fixes follow from it: require authorization on every route, and pin the bucket to the one that was configured. If you run any service that signs URLs on behalf of users, check both.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need credentials for my AWS account?
No. The advisory says Budibase signs the URL with the credentials stored in the datasource, so the caller does not need them.
Sources
Last reviewed: 19 October 2026.
