CVE-2026-100687

Executive Summary

CVE-2026-100687 is a credential-exposure vulnerability in Budibase Server before version 3.45.0, in which plaintext datasource credentials (database passwords and API keys) are improperly redacted—or not redacted at all—before external table update events are broadcast to the Builder collaboration websocket room. Any user holding Builder-level access can passively observe these websocket messages during routine table save or delete operations and extract unredacted secrets for connected external datasources. The issue carries a CVSS 3.1 base score of 5.5 (High confidentiality impact, Low integrity impact) and requires authenticated, privileged access to exploit, but its passive, low-skill exploitation profile makes it a significant insider-risk and lateral-movement vector for organizations that delegate Builder roles broadly.

Technical Analysis

The vulnerability class here is CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, specifically the failure to apply output redaction to a data structure before it is serialized and transmitted over a collaboration channel.

Budibase is a low-code application platform. Its Builder is a collaborative visual development environment where multiple authenticated users edit applications ("apps"), datasources, and tables simultaneously. To keep multiple Builder sessions synchronized, the server uses a websocket-based collaboration room (a real-time broadcast channel) that pushes state-change events—such as table save and table delete operations—to all connected Builder clients in the same room.

The defect is that when a table operation involving an external datasource occurs, the server constructs an event payload that includes the datasource object itself. That datasource object contains the connection configuration, and per the NVD description it includes plaintext database passwords and API keys. In a correctly implemented system, credential fields would be stripped or replaced with placeholder values (redaction) before the object is placed on the wire, because the collaboration room is a shared, multi-user context—not a privileged secrets channel. Budibase Server before 3.45.0 failed to perform this redaction step. The credential-bearing object was therefore broadcast verbatim to every socket joined to the Builder collaboration room.

Key characteristics of this flaw:

• The secret is not brute-forced or extracted from storage. It is delivered to the client by the server as part of a normal collaboration event. The attacker does not need to defeat encryption, hashing, or access controls on the credential store; they simply need to be a participant in the room where the event is broadcast.
• The trigger is a legitimate, routine action. A table save or table delete operation performed by any authorized Builder user emits the event. The attacker only needs to be present when it happens, or to have tooling that captures the traffic continuously.
• The exposure is server-driven and passive from the attacker's perspective. A browser developer-tools websocket inspector or a proxy positioned between the client and server is sufficient to read the broadcast frame. No crafted payload, no memory corruption, no injection primitive is involved.
• The privilege requirement is Builder access. This is why the CVSS vector is PR:H (Privileges Required: High) rather than None—the attacker must already hold an account permitted into the Builder collaboration context. It is not an unauthenticated, internet-facing remote code execution bug. It is a privilege-boundary failure: within the Builder role, credentials leak that should never be visible to that role at all.

Because the NVD description does not enumerate specific function names, endpoint paths, event names, or field names, the precise redaction function that was missing cannot be stated without fabrication. What can be stated with confidence from the description is the mechanism: unredacted datasource object serialization into a websocket broadcast. "Insufficient technical detail is available" to go below that level of code specificity; any naming of internal methods would be invented and is therefore omitted.

The 3.45.0 boundary given in the description implies the fix was a redaction enforcement applied at the point of event construction or serialization—i.e., credential fields are masked before broadcast.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The attack chain below is inferred strictly from the vulnerability class and the NVD description; no specific code patterns, function names, or endpoints are invented.

1. Reconnaissance / target identification. The attacker holds (or obtains) an account with Builder-level access to a Budibase deployment. This may be a legitimate but over-privileged internal user, a compromised low-trust account, or a contractor/multi-tenant participant added to a shared Builder workspace. The attacker identifies that the target instance connects to one or more external datasources—the preconditions the description specifies, since the flaw concerns external table updates. No scanning of a public surface is required; the "reconnaissance" here is simply knowing that the Builder collaboration feature is in active use.

2. Triggering the flaw class. The vulnerability is triggered by the normal operation of the platform, not by attacker input. When any Builder user performs a table save or table delete operation on a table backed by an external datasource, Budibase Server emits a collaboration event to the Builder websocket room. Because redaction is absent, that event payload carries the datasource object with plaintext credentials embedded. The attacker does not need to cause the event; they need only be in the room when it fires. In a multi-user environment this is near-certain to occur during ordinary development activity.

3. Payload / execution method (vulnerability-class level). The attacker establishes a websocket connection to the same Builder collaboration room (as is normal for any Builder client) and passively captures the broadcast frames. Because the credentials are present in cleartext in the event data—not hashed, not truncated, not masked—the attacker reads them directly. This is observation, not exploitation of a code-execution primitive. Browser dev-tools websocket inspection or an intercepting proxy is sufficient.

4. Post-exploitation impact. The extracted database passwords and API keys are valid secrets for the downstream systems the datasource connects to. The attacker can:

• Authenticate directly to the external database referenced by the datasource, moving laterally out of Budibase into backend infrastructure with the privileges of the configured datasource account.
• Use captured API keys to call third-party services (SaaS, payment, messaging, internal APIs) with the key's permissions.
• Persist access by using the harvested credentials independently of Budibase, surviving revocation of their Builder account (though not revocation of the datasource credentials themselves).
• Repeat the capture over time, harvesting additional secrets as new datasources are saved or deleted.

The CVSS vector reflects this profile precisely: AV:N (the websocket is reachable remotely), AC:L (no special conditions; routine operation emits the secret), PR:H (a Builder account is required), UI:N (no victim interaction beyond ordinary platform use), S:U (scope unchanged—the leak occurs within the Budibase trust boundary, though it enables expansion into connected systems), C:H (full cleartext credential disclosure), I:L (the attacker's ability to influence saved/deleted state is limited), A:N (no availability impact).

Impact Assessment

Business impact. The direct consequence is disclosure of credentials protecting backend databases and third-party services. Because credentials are high-value, long-lived, and often reused or broadly scoped in low-code deployments, the blast radius can extend well beyond the Budibase instance itself. An attacker who harvests a production database password by watching a colleague save a table in the Builder does not need to exploit Budibase again; they attack the database. This converts a moderate-looking 5.5 into a potential pivot into core data stores, with downstream risks of data exfiltration, data integrity tampering, and lateral movement into adjacent services via stolen API keys.

Affected systems. Budibase Server deployments before 3.45.0 that (a) use external datasources and (b) have more than one participant in the Builder collaboration context—or a single malicious participant. Single-user self-hosted instances with no external datasources and no untrusted Builder participants are effectively out of scope.

CVSS subscores.

• Confidentiality: High — plaintext passwords and API keys are fully exposed to the attacker.
• Integrity: Low — limited attacker ability to modify state (the flaw is primarily a read/leak issue; the I:L reflects constrained change potential rather than data destruction).
• Availability: None — no service disruption component.
• Privileges Required: High — Builder access is a meaningful barrier, which is why the score is not Critical.

Exposure-window note. EPSS has not yet been scored by FIRST.org; no exploitation-in-the-wild evidence is known and CISA KEV does not list this CVE. The realistic threat is insider and trusted-participant risk, not mass internet exploitation. Organizations with broad Builder role assignments, external contractors, or multi-tenant Budibase configurations should treat this as elevated.

Detection Guidance

Sigma Rule

This rule targets the server-side event that constructs/serializes a datasource object for a collaboration broadcast, and specifically flags cases where credential-type fields are present in the emitted payload. Adjust log source to your Budibase application log pipeline.

title: Budibase Builder WebSocket Broadcast of Unredacted Datasource Credentials
id: 8f2c1a44-7b3d-4e21-9c0a-1d5e6f7a8b90
status: experimental
description: Detects Budibase Server (<3.45.0) collaboration events carrying datasource objects with cleartext credential fields during table save/delete operations.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100687
author: valtersit.com
date: 2026/01/01
logsource:
  product: budibase
  service: server
detection:
  selection_event:
    event_type:
      - 'table.save'
      - 'table.delete'
      - 'datasource.update'
  selection_cred:
    payload_contains|contains:
      - 'password'
      - 'apiKey'
      - 'api_key'
      - 'credentials'
  filter_redacted:
    payload_contains|contains:
      - '******'
      - '[REDACTED]'
      - 'redacted'
  condition: selection_event and selection_cred and not filter_redacted
falsepositives:
  - Legitimate logging of redacted datasource metadata
level: medium
tags:
  - attack.t1213
  - attack.t1552
  - cve.2026.100687

YARA Rule

This rule scans log files, proxy captures, or websocket frame dumps for a collaboration event that pairs a table-operation marker with cleartext credential fields—indicative of an unredacted broadcast.

rule CVE_2026_100687_Budibase_Unredacted_Datasource_Broadcast
{
    meta:
        description = "Detects Budibase websocket broadcast frames containing unredacted datasource credentials (CVE-2026-100687)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100687"
        cve = "CVE-2026-100687"

    strings:
        $evt1 = "table.save" ascii nocase
        $evt2 = "table.delete" ascii nocase
        $ds   = "datasource" ascii nocase
        $pw   = "password" ascii nocase
        $key1 = "apiKey" ascii nocase
        $key2 = "api_key" ascii nocase
        $red1 = "******" ascii
        $red2 = "REDACTED" ascii nocase

    condition:
        (uint16(0) == 0x7b7b or true) and
        ($ds and ($pw or $key1 or $key2)) and
        ($evt1 or $evt2) and
        not ($red1 or $red2)
}

Suricata IDS Rule

Detects cleartext credential field names co-occurring with Budibase collaboration event markers inside HTTP-tunneled or raw websocket (TCP) traffic on common Budibase ports.

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-100687 Budibase Unredacted Datasource Credential Broadcast"; flow:established,to_client; content:"datasource"; nocase; content:"password"; nocase; content:"table"; nocase; pcre:"/(apiKey|api_key)/i"; classtype:attempted-recon; reference:cve,2026-100687; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100687; sid:2026100687; rev:1;)

alert tcp $HOME_NET 4001 -> $HOME_NET any (msg:"CVE-2026-100687 Budibase WebSocket Datasource Secret Leak"; flow:established,from_server; content:"|7b|"; content:"credentials"; nocase; content:"datasource"; nocase; pcre:"/\"(password|apiKey|api_key)\"\s*:\s*\"[^\"]+\"/i"; classtype:policy-violation; reference:cve,2026-100687; sid:2026100688; rev:1;)

Elastic Detection

EQL rule against Budibase server/application logs to catch collaboration broadcast events that include credential-bearing payloads.

sequence by host.name
  [ any where event.category == "application" and
          event.action in ("table.save", "table.delete", "datasource.update") ]
  [ any where event.category == "application" and
          wildcard(event.original, "*datasource*") and
          wildcard(event.original, "*password*") and
          not wildcard(event.original, "*REDACTED*") ]

EQL hunting variant for direct payload inspection:

any where
  event.dataset == "budibase.server" and
  wildcard(message, "*table*") and
  (wildcard(message, "*password*") or wildcard(message, "*apiKey*") or wildcard(message, "*api_key*")) and
  not wildcard(message, "*redacted*") and
  not wildcard(message, "*\\*\\*\\*\\**")

Splunk SPL Query

index=budibase sourcetype=budibase:server
| search (event_type="table.save" OR event_type="table.delete" OR event_type="datasource.update")
| search (payload="*password*" OR payload="*apiKey*" OR payload="*api_key*" OR payload="*credentials*")
| search NOT (payload="*REDACTED*" OR payload="******" OR payload="*redacted*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(user) as actor values(datasource) as datasource
        by host event_type
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Websocket-frame hunting variant (if frames are forwarded to a proxy index):

index=proxy sourcetype=websocket OR sourcetype=ws_frame
| regex _raw="(?i)(table\.?(save|delete)|datasource)"
| regex _raw="(?i)(password|apiKey|api_key|credentials)"
| regex _raw!="(?i)(redacted|\*{4,})"
| table _time src dest uri _raw

Wazuh OSSEC Rule

Wazuh XML rule to alert when Budibase server logs emit a collaboration event carrying credential-type fields without a redaction marker.

<group name="budibase,cve-2026-100687,">
  <rule id="2026100687" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">table\.(save|delete)|datasource\.update</field>
    <regex type="pcre2">(?i)(password|apiKey|api_key|credentials)</regex>
  </rule>

  <rule id="2026100689" level="12">
    <if_sid>2026100687</if_sid>
    <regex type="pcre2">^(?!.*(?:redacted|\*{4,})).*$</regex>
    <description>CVE-2026-100687: Budibase broadcast of UNREDACTED datasource credentials detected</description>
    <mitre>
      <id>T1213</id>
      <id>T1552</id>
    </mitre>
    <group>credential_access,pci_dss_10.2.1,gdpr_IV_35.7.d,</group>
  </rule>

  <rule id="2026100690" level="6">
    <decoded_as>json</decoded_as>
    <field name="event_type">table\.(save|delete)</field>
    <description>Budibase table operation observed (collaboration event baseline)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, commit reference, or backported fix is available. The version boundary 3.45.0 appears only in the NVD description; treat it as the intended fixed version, not a verified artifact.

1. Immediate mitigations (until a verified patch is applied):

• Restrict Builder collaboration membership. Limit Builder/Admin roles to the smallest possible set of trusted identities. This directly addresses the PR:H precondition—the fewer participants in the websocket room, the smaller the exposure window. Remove dormant, shared, and external/contractor Builder accounts.
• Rotate external datasource credentials. Any database password or API key that has been configured as a Budibase external datasource on an affected instance should be treated as potentially exposed, especially in multi-user environments, and rotated to new secrets. Rotate proactively rather than waiting for evidence of compromise.
• Segment and least-privilege datasource accounts. Configure each external datasource with a dedicated, minimally privileged account scoped to only the objects Budibase requires. This caps the blast radius if a credential is harvested (e.g., read-only where writes are not needed).
• Audit Builder participants and capture. Review logs/records of who held Builder access during the vulnerable period, and treat any such user as a potential recipient of leaked credentials.
• Network controls. Consider restricting the collaboration websocket path to a trusted management network or VPN rather than broad internal reachability; if the websocket is TLS-encrypted, note that encryption does not mitigate this issue because the client is the intended recipient of the cleartext secret.

2. Patch / upgrade steps:

• Monitor the vendor's release channel and NVD/OSV entries for Budibase Server 3.45.0 (or later) and confirm an official security advisory or commit exists before relying on the fix.
• When a verified build is available: test the upgrade in a non-production environment, verify that datasource objects broadcast during table save/delete are redacted (inspect websocket frames directly), then deploy to production.
• After upgrade, re-rotate all datasource credentials that were exposed during the vulnerable window—upgrading stops new leaks but does not invalidate secrets already disclosed.

3. Long-term hardening:

• Implement and enforce a redaction-by-default serialization policy for any object leaving a shared/collaborative context; secrets should require explicit opt-in to be included and should never traverse multi-user channels.
• Adopt secret references rather than inline secrets in datasource configurations (e.g., external secret manager lookups), so the datasource object itself never contains plaintext credentials to leak.
• Apply least privilege and periodic access review to all collaboration-capable roles in low-code platforms.
• Add continuous detection (rules above) for credential fields appearing in outbound collaboration payloads, as a regression guard against future redaction failures.

References

• NVD — CVE-2026-100687: https://nvd.nist.gov/vuln/detail/CVE-2026-100687
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• Budibase project (monitor releases for 3.45.0 and any security advisory): https://github.com/Budibase/budibase/releases

Exploitation status. No public proof-of-concept, exploit code, or Nuclei template is available (POC_STATUS: None). CISA KEV does not list CVE-2026-100687, and EPSS has not yet been scored by FIRST.org. No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing; the primary realistic threat remains malicious or compromised insiders holding Builder access.