PT-2026-44055 · Budibase · Budibase

Adrgs · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-46427

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.38.3

Description The removeSecrets() function in the server SDK fails to mask datasource configuration fields unless their schema type is DatasourceFieldType.PASSWORD. Because the Snowflake integration defines the privateKey field as SENSITIVE LONGFORM, it is skipped by the filter. An authenticated user with BASIC permissions and any app role can access the '/api/datasources/:datasourceId' endpoint to retrieve the full Snowflake PEM (Privacy Enhanced Mail) private key in plaintext.

Recommendations Update to version 3.38.3.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-46427

Affected Products

Budibase

References · 4

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-qv26-4hvj-m7fv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46427 · Security Note
• https://twitter.com/CVEnew/status/2059718137592033733 · Twitter Post
• https://twitter.com/infoflowcloud/status/2059719065120231784 · Twitter Post