CVE-2026-54356

Executive Summary

CVE-2026-54356 describes a critical integrity vulnerability in Budibase, an open-source low-code platform. Prior to version 3.41.3, an authenticated user with a BASIC role in a published application could exploit an insecure endpoint to generate signed and public S3 URLs using the application's configured S3 datasource credentials. This allows an attacker to control arbitrary S3 bucket and key values in URL generation, potentially leading to unauthorized modification or deletion of data within the linked S3 bucket, despite no direct confidentiality impact.

Technical Analysis

The vulnerability, identified as CWE-862 (Missing Authorization), affects Budibase versions prior to 3.41.3. Specifically, the POST /api/attachments/:datasourceId/url endpoint, implemented in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts, lacks sufficient authorization checks. An authenticated user possessing a BASIC role within a published Budibase application can invoke this API endpoint.

The core of the flaw lies in the ability for this low-privileged user to supply attacker-controlled bucket and key values as parameters to the endpoint. The Budibase server, acting on behalf of the user, then proceeds to generate signedUrl and publicUrl values. These URLs are not generated using the user's limited permissions but rather leveraging the stored, potentially more privileged, S3 datasource credentials configured within the Budibase instance.

By generating signed URLs for arbitrary S3 locations, an attacker can effectively bypass intended access controls. While the NVD description indicates no direct confidentiality impact (C:N), the high integrity (I:H) and low availability (A:L) impacts suggest that the generated signed URLs could be for operations such as uploads or deletions. If the S3 datasource credentials have broad write or delete permissions, the attacker could then utilize these generated signed URLs to perform unauthorized modifications (e.g., uploading malicious files, replacing legitimate files) or cause denial of service (e.g., deleting critical data) within the S3 buckets accessible by Budibase. The vulnerability exposes the application's S3 interaction mechanism to a less trusted user context, allowing for credential abuse in a controlled manner.

Exploitation Scenarios

Exploitation of CVE-2026-54356 involves an authenticated, low-privileged user manipulating the Budibase application's S3 URL generation functionality.

1. Reconnaissance/Target Identification: An attacker identifies a publicly accessible or internal Budibase instance. They gain access to a published application within Budibase, acquiring an authenticated user account with a 'BASIC' role.
2. Authentication & Endpoint Access: The attacker authenticates to the Budibase published application using their BASIC role credentials. They then identify and target the vulnerable API endpoint: POST /api/attachments/:datasourceId/url. The :datasourceId path parameter would correspond to an existing S3 datasource configured within the Budibase environment.
3. Triggering the Flaw (Payload/Execution): The attacker crafts a malicious HTTP POST request to the identified endpoint. In this request, they supply arbitrary, attacker-controlled values for the bucket and key parameters. For example, the attacker might specify a bucket name and a key path within that bucket that they wish to modify or delete, or even create. The Budibase server, due to the missing authorization checks, processes this request using its internally stored S3 datasource credentials.
4. Post-Exploitation Impact: Upon successful exploitation, the Budibase server returns signedUrl and publicUrl values to the attacker. These URLs are backed by the application's S3 credentials, not the attacker's limited BASIC role.
   • High Integrity Impact (I:H): If the generated signedUrl is a presigned URL for an S3 PutObject or CopyObject operation, the attacker can use this URL to upload new files, overwrite existing files, or modify content within the S3 bucket associated with the Budibase datasource. This could lead to data tampering, injection of malicious content, or defacement of application resources.
   • Low Availability Impact (A:L): If the generated signedUrl is a presigned URL for an S3 DeleteObject operation, the attacker could use it to delete arbitrary objects or even entire prefixes within the accessible S3 bucket, leading to data loss or service disruption.
   • No Confidentiality Impact (C:N): The vulnerability primarily enables the generation of URLs for actions (like upload/delete), not direct reading of arbitrary sensitive data from the S3 bucket. While knowledge of object keys could be inferred, direct data extraction is not the stated impact.

No public Proof-of-Concept (PoC) or exploit code is currently known, meaning the attack chain is inferred from the vulnerability description and common patterns of S3 credential abuse.

Impact Assessment

The impact of CVE-2026-54356 is significant, primarily affecting the integrity and, to a lesser extent, the availability of data managed by Budibase applications that integrate with S3 datastores.

• Integrity (I:H - High): The CVSS score assigns a "High" impact to integrity. This is the most severe aspect, as an attacker can cause extensive, unauthorized modifications to data. This includes altering critical application files, injecting malicious scripts into content served from S3, or overwriting legitimate user data. Such actions can lead to data corruption, application malfunction, or compromise of user trust. The ability to craft URLs for arbitrary bucket and key values means an attacker could target any resource within the scope of the Budibase application's S3 credentials.
• Availability (A:L - Low): The CVSS score assigns a "Low" impact to availability. While less severe than integrity impact, the ability to generate signed URLs for deletion operations could allow an attacker to delete specific files or entire data sets within the S3 bucket. This could lead to temporary or permanent service disruption for the Budibase application or its users, depending on the criticality of the deleted data.
• Confidentiality (C:N - None): The CVSS score indicates "None" for confidentiality. This implies that the vulnerability does not directly facilitate the unauthorized disclosure or exfiltration of sensitive information from the S3 bucket. The focus is on the unauthorized modification or destruction of data, rather than its exposure.
• Attack Vector (AV:N - Network): The vulnerability is exploitable over the network, meaning an attacker does not need local access to the Budibase server.
• Attack Complexity (AC:L - Low): The attack requires low complexity, indicating that specialized conditions or extensive effort are not needed beyond obtaining authenticated access.
• Privileges Required (PR:L - Low): Only a low-privileged authenticated user (BASIC role in a published app) is required to exploit this vulnerability. This significantly broadens the potential attack surface, as such accounts are relatively easier to obtain or compromise compared to administrative credentials.
• User Interaction (UI:N - None): No user interaction is required for the attacker to perform the exploitation once authenticated.
• Scope (S:U - Unchanged): The vulnerability affects resources within the same security scope as the Budibase application.

The blast radius extends to any S3 buckets or objects accessible by the Budibase application's S3 datasource credentials. If these credentials are overly permissive (e.g., granting full S3 access to * buckets), the potential for widespread data compromise is significant. Organizations using Budibase with S3 integration should consider this a critical vulnerability due to the high integrity impact and low privilege requirements for exploitation.

Detection Guidance

Sigma Rule

title: Budibase S3 Signed URL Generation Abuse
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx # Generate a unique UUID
related:
  - CVE-2026-54356
status: experimental
description: Detects POST requests to the Budibase API endpoint used for generating S3 signed URLs, indicating potential abuse.
author: valtersit.com
logsource:
  category: webserver
  service: access_log
detection:
  selection:
    http_method: POST
    uri|contains: '/api/attachments/'
    uri|endswith: '/url'
  condition: selection
level: high
tags:
  - attack.t1552 # Unsecured Credentials
  - cve.2026.54356

YARA Rule

rule Budibase_Vulnerable_Static_Files {
  meta:
    author = "valtersit.com"
    date = "2024-07-29"
    description = "Identifies Budibase server files related to CVE-2026-54356 vulnerability description."
    cve = "CVE-2026-54356"
    severity = "low"
    licence = "CC BY-NC 4.0"
  strings:
    $s1 = "packages/server/src/api/routes/static.ts" ascii wide
    $s2 = "packages/server/src/api/controllers/static/index.ts" ascii wide
    $s3 = "POST /api/attachments/:datasourceId/url" ascii wide
    $s4 = "signedUrl" ascii wide
    $s5 = "publicUrl" ascii wide
    $s6 = "Budibase is an open-source low-code platform." ascii wide
  condition:
    (1 of ($s1, $s2)) and (1 of ($s3, $s4, $s5, $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Budibase CVE-2026-54356 S3 Signed URL Abuse Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/^\/api\/attachments\/[a-zA-Z0-9_-]+\/url$/"; classtype:web-application-attack; sid:202654356; rev:1;)

Elastic Detection

http.request.method == "POST" and url.path : "/api/attachments/*/url"

Splunk SPL Query

index=* sourcetype="access_combined*" (method="POST" AND uri_path="/api/attachments/*/url")
| stats count by _time, src_ip, user, method, uri_path
| `security_content_annotations`
| `security_content_get_risk_score`
| sort -_time

Wazuh OSSEC Rule

<group name="web,attack,">
  <rule id="100001" level="10">
    <if_sid>31101</if_sid> <!-- HTTP POST request -->
    <url>%POST /api/attachments/\S+/url%</url>
    <field name="user" type="pcre2">\S+</field> <!-- Expecting an authenticated user -->
    <description>Budibase CVE-2026-54356 S3 Signed URL Abuse Attempt (Low Privileged Authenticated User).</description>
    <group>attack,cve,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source has been identified by external intelligence sources. However, the NVD description explicitly states that this issue is fixed in Budibase version 3.41.3. Organizations should prioritize verifying this vendor-reported fix.

1. Immediate Mitigations:

   • Restrict Network Access: If possible, limit direct public exposure of the Budibase instance. Place it behind a Web Application Firewall (WAF) to filter suspicious requests or restrict access to trusted networks/VPNs only.
   • Review S3 Datasource Permissions (Least Privilege): Immediately review and restrict the IAM policies attached to the S3 credentials used by your Budibase application. Implement the principle of least privilege, granting only the absolute minimum permissions required for Budibase to operate. Specifically, limit write, delete, and extensive list object permissions to specific, narrow prefixes or buckets. Avoid granting s3:* or broad wildcard (*) permissions.
   • Monitor API Endpoint Usage: Implement enhanced logging and monitoring for the POST /api/attachments/:datasourceId/url endpoint. Look for unusual activity, frequent requests from a single user, or attempts to generate URLs for unexpected buckets or keys.
   • Limit Published Application Access: For published Budibase applications, ensure that user accounts with 'BASIC' roles are assigned judiciously and their privileges are strictly controlled.

2. Patch/Upgrade Steps:

   • Upgrade Budibase: Although external patch evidence is flagged as "UNPATCHED" by tracked sources, the NVD description states the issue is fixed in Budibase version 3.41.3. Organizations running vulnerable versions (< 3.41.3) should plan to upgrade to version 3.41.3 or a later stable release as soon as possible.
   • Verify Fix: After upgrading, thoroughly test Budibase's functionality and S3 interactions to ensure the patch has been successfully applied and has resolved the vulnerability without introducing regressions.

3. Long-Term Hardening:

   • Regular Security Audits: Conduct regular security audits and penetration tests on Budibase deployments, focusing on authentication, authorization, and cloud service integrations.
   • API Security Best Practices: Implement robust API security practices, including strong authentication, granular authorization (e.g., using attribute-based access control), and input validation for all API endpoints, especially those interacting with external services like S3.
   • Credential Management: Ensure all cloud service credentials are managed securely, rotated regularly, and are never hardcoded or overly permissive. Utilize IAM roles where possible instead of static credentials.
   • Network Segmentation: Deploy Budibase within a segmented network environment to limit lateral movement in case of a breach.

References

• NVD - CVE-2026-54356 Detail
• Budibase GitHub Repository (Refer to changelogs or release notes for version 3.41.3 for specific patch details when available)
• CWE-862: Missing Authorization
• AWS S3 Presigned URLs Documentation
• MITRE ATT&CK - T1552 Unsecured Credentials