CVE-2026-41428 json
Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
published 2026-04-16 6 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-25618 , GHSA-8783-3wgf-jggf
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.
Patch / fix
- budibase budibase 3.35.4
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @budibase/backend-core | <=3.35.3 |
no fix listed |
Affected products
- Budibase budibase
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf
exploit, web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-41428
advisory
-
github.com
/Budibase/budibase
package
Sources
- CVE List CVE-2026-41428
- GitHub Advisory GHSA-8783-3wgf-jggf
- NVD CVE-2026-41428
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.