CVE-2026-41428 - Vulnerability Analysis

Overview

Budibase < 3.35.4 contains an authentication bypass caused by unanchored regex matching of public endpoint patterns against ctx.request.url including query strings, letting attackers access protected endpoints by appending public paths as query parameters, exploit requires attacker to be authenticated.

Severity & Score

Impact

Authenticated attackers can bypass authentication to access protected endpoints, potentially exposing sensitive data or functionality.

Mitigation

Update to version 3.35.4 or later.

References

• https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner