CVE-2026-100683

Executive Summary

CVE-2026-100683 is a SQL injection vulnerability in Budibase's @budibase/server package affecting versions before 3.45.0. The flaw exists in packages/backend-core/src/sql/sqlTable.ts, where MySQL and MSSQL column-rename DDL statements are constructed by directly interpolating identifiers into a raw query string instead of using the project's quoteMySqlIdentifier / quoteSqlServerIdentifier helpers. An attacker with DDL rights on a connected MySQL/MSSQL datasource can create a specially-named column that injects SQL when a Budibase builder later renames it through the UI, ultimately allowing arbitrary reads, writes, or destructive operations on the connected database outside Budibase's row/table permission model.

Technical Analysis

The vulnerability is a classic identifier-quoting failure leading to SQL injection (CWE-89). In packages/backend-core/src/sql/sqlTable.ts, the column-rename DDL path builds raw SQL by interpolating column identifiers directly:

• MySQL: the identifier is embedded within backticks.
• MSSQL: the identifier is embedded as a single-quoted literal passed to sp_rename.

Critically, the code does not apply the project's dedicated quoteMySqlIdentifier or quoteSqlServerIdentifier helpers, which exist specifically to escape identifier metacharacters. As a result, a column name containing a backtick (MySQL) or a single quote (MSSQL) plus trailing SQL text will break out of the intended quoting context, terminating the identifier and causing the appended text to be interpreted as SQL.

The attack requires a two-stage precondition:

1. Column planting: An attacker with DDL rights on the connected datasource creates a column whose name contains the escape character plus injected SQL. Budibase's schema introspection reads and stores this name verbatim without sanitization.
2. Trigger via rename: When a Budibase builder renames that column through the UI (POST /api/tables with _rename.old), the stored malicious name flows into the DDL builder. The embedded quote character terminates the identifier and the injected SQL is executed.

The impact is amplified on MySQL because the connection is opened with multipleStatements: true, enabling stacked statements. Injection therefore runs with the privileges of Budibase's datasource user, bypassing Budibase's application-layer row/table permission model entirely. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:C) reflects network accessibility, high attack complexity (requires privileged DDL access and a builder-initiated rename), low privileges, user interaction (UI-driven rename), and changed scope (impact escapes to the connected database).

Exploitation Scenarios

No public PoC is available; the attack chain below is derived strictly from the NVD description and the vulnerability class.

1. Reconnaissance / target identification: The attacker identifies a Budibase deployment with a connected MySQL or MSSQL datasource. The attacker must already possess DDL rights on that datasource — for example, a database account provisioned for Budibase that is over-permissioned, or a compromised credential for the backend database.

2. Triggering the flaw class: The attacker executes DDL against the connected database to create a column whose name contains the escape metacharacter plus additional SQL. For MySQL, the name contains a backtick followed by injected SQL; for MSSQL, the name contains a single quote followed by injected SQL. Budibase's schema introspection captures this name verbatim and stores it.

3. Payload/execution method: A Budibase builder later performs a column rename through the UI. This issues POST /api/tables carrying a _rename.old value referencing the malicious column. The rename handler in packages/backend-core/src/sql/sqlTable.ts interpolates the stored identifier into the raw DDL string without using quoteMySqlIdentifier / quoteSqlServerIdentifier. The embedded quote character closes the identifier context, and the appended SQL executes. On MySQL, multipleStatements: true permits stacked statements in the same round trip.

4. Post-exploitation impact: Because the injected statements execute as Budibase's datasource user, the attacker gains arbitrary reads, writes, or destructive operations on the connected database that are not constrained by Budibase's row/table permission model.

Impact Assessment

Successful exploitation yields high confidentiality, integrity, and availability impact on the connected MySQL/MSSQL datasource (CVSS C:H/I:H/A:H). The scope change (S:C) indicates the compromise escapes Budibase's own security boundary and reaches the underlying database, meaning Budibase's application-level permission model no longer governs access. Blast radius is defined by the privileges of the Budibase datasource account: an over-privileged account exposes all schemas it can reach, enabling data exfiltration, data tampering, or destructive DDL/DML. The attack requires high complexity (AC:H) and user interaction (UI:R) — specifically a builder initiating a rename — and low privileges (PR:L), reflecting the prerequisite DDL rights. Overall CVSS base score: 8.0 (High).

Detection Guidance

Sigma Rule

title: Budibase SQL Identifier Injection via Column Rename
id: 8f3c1a52-6b7e-4d21-9c0a-1e2f3a4b5c6d
status: experimental
description: Detects Budibase builder column-rename requests potentially carrying SQL metacharacters in table/column identifiers (CVE-2026-100683)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100683
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: '/api/tables'
  selection_meta:
    cs-uri-query|contains:
      - '_rename'
      - '`'
      - '%60'
      - "''"
  condition: selection_method and selection_uri and selection_meta
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate column names containing special characters (rare)
level: high

YARA Rule

rule CVE_2026_100683_Budibase_SQLIdentifierInjection
{
    meta:
        description = "Detects Budibase sqlTable.ts patterns lacking identifier quoting helpers (CVE-2026-100683)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100683"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $sqlfile = "sqlTable.ts" ascii wide
        $helper_my = "quoteMySqlIdentifier" ascii wide
        $helper_ms = "quoteSqlServerIdentifier" ascii wide
        $sprename = "sp_rename" ascii wide
        $multiple  = "multipleStatements" ascii wide
    condition:
        $sqlfile and not ($helper_my and $helper_ms)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100683 Budibase Column Rename SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/tables"; content:"_rename"; http.request_body; content:"`"; nocase; classtype:web-application-attack; reference:cve,2026-100683; sid:2026100683; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [http where http.request.method == "POST" and http.request.path : "/api/tables"]
  [http where http.request.body.text : "*_rename*" and http.request.body.text : ("*`*" or "*''*")]

Splunk SPL Query

index=web OR index=proxy
| search cs_method=POST uri_path="*/api/tables*" (uri_query="*_rename*" OR request_body="*_rename*") (request_body="*`*" OR uri_query="*%60*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, host
| where count > 0

Wazuh OSSEC Rule

<group name="budibase,web,sql_injection,">
  <rule id="100683" level="12">
    <if_sid>31100</if_sid>
    <match>POST /api/tables</match>
    <regex>_rename|%60|`</regex>
    <description>CVE-2026-100683: Budibase column rename SQL injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in 3.45.0, but this cannot be corroborated by any tracked patch source in the provided data.

1. Immediate mitigations:

   • Restrict DDL privileges on MySQL/MSSQL datasource accounts connected to Budibase. Remove CREATE/ALTER/DROP rights where not strictly required.
   • Audit existing schema objects for column names containing backticks (MySQL) or single quotes (MSSQL), and remove/quarantine any suspicious identifiers.
   • Disable or restrict the Budibase builder role to trusted personnel only.
   • Disable multipleStatements at the connection layer if configurable, to eliminate stacked-statement execution.

2. Patch/upgrade steps:

   • Upgrade @budibase/server to 3.45.0 or later per the NVD description. Verify the release artifact and changelog directly from the vendor before deploying, given the 0/4 patch confidence rating.

3. Long-term hardening:

   • Enforce parameterized/parameter-safe DDL construction and mandatory use of quoteMySqlIdentifier / quoteSqlServerIdentifier in code review.
   • Apply least-privilege database accounts for all Budibase datasources.
   • Monitor POST /api/tables for identifier metacharacters and alert on anomalous rename activity.
   • Maintain an inventory of connected datasources and their privilege grants.

References

• NVD — CVE-2026-100683: https://nvd.nist.gov/vuln/detail/CVE-2026-100683
• Budibase project repository (packages/backend-core/src/sql/sqlTable.ts) — vendor source
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command — https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CISA KEV: Not listed as of this report.

No public PoC, Nuclei template, exploit code, or exploit-in-the-wild evidence is available for CVE-2026-100683. No threat actor campaigns have been associated with this CVE in the provided data.