CVE-2026-54350 is a critical flaw (CVSS 10.0) in Budibase before 3.39.12. Query parameters are placed into a raw JSON body without escaping, so an unauthenticated visitor to a published app can widen a query and read a whole collection. Public write queries can be affected too. Upgrade to 3.39.12.
What's affected
- Budibase before 3.39.12, per the record.
- Fixed in 3.39.12.
- Published apps backed by MongoDB, CouchDB, Elasticsearch, DynamoDB PartiQL, or a REST datasource with a JSON body. Modification needs a builder to have published a public write query.
How to check if you're exposed
Find your Budibase version in the admin area or the image tag, and compare it with 3.39.12. Then list the queries in your apps. Look for queries on the data sources named above whose role is Public, and note which of them write data. Those are the ones the record describes as reachable by an anonymous visitor.
What to do now
- Upgrade Budibase to 3.39.12 or later.
- Review each published app and set queries that do not need anonymous access to a role that requires sign in.
- Remove or restrict public write queries.
- Check the backing databases for unexpected reads or changes, and restore from backup if data was altered.
Why it matters
The classes are CWE-89, CWE-943: SQL injection in the record and improper neutralization in a data query language. The advisory says the validator rejected only template markers in user input and did not escape JSON characters, so a value could add its own keys to the filter object once parsed.
The result is that a request meant to fetch one record can match every record. The record does not mark the CVE as exploited in the wild. The wider lesson is to build queries with structured values, not by pasting text into a JSON string.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Does it apply to SQL datasources?
The record lists MongoDB, CouchDB, Elasticsearch, DynamoDB PartiQL and REST with a JSON body. It does not list other sources, but upgrade anyway.
Sources
Last reviewed: 19 October 2026.
