CVE-2026-54351: Webhook Mass Assignment in Budibase

CVE-2026-54351 is a high severity flaw (CVSS 8.2) in Budibase before 3.39.9. The public webhook trigger endpoint copies the request body into automation parameters, which lets a caller overwrite the internal appId and run an automation in a victim workspace. Upgrade to 3.39.9.

What's affected

• Budibase before 3.39.9, per the record.
• Fixed in 3.39.9.
• Instances that expose webhook triggers. The advisory describes the asynchronous path, which is the default for webhooks without a collect step.

How to check if you're exposed

Check your Budibase version against 3.39.9. Then list automations that use a webhook trigger, and note which workspaces they belong to. On multi-workspace or multi-tenant deployments, the cross-workspace effect described in the record is the worry, so start there. Review automation run history for runs you did not expect.

What to do now

1. Upgrade Budibase to 3.39.9 or later.
2. Inventory webhook triggered automations and delete the ones you no longer use.
3. Check automation logs and the data in each workspace for unexpected changes.
4. Restrict network access to the webhook endpoints where you can.

Why it matters

The class is CWE-915, improperly controlled modification of dynamically determined object attributes, usually called mass assignment. The advisory shows the controller spreading the raw request body into the same object that holds the server chosen appId, so a field in the body could replace it.

The fix principle is simple: keep trusted values and caller supplied values in separate places. The record does not mark the CVE as exploited in the wild. The CVSS vector lists high attack complexity, but the scope change reflects the jump into another workspace.

For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.

Quick check

Sources

• https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44p

Last reviewed: 19 October 2026.