Budibase Server prior to version 3.45.0 contains a security flaw that causes it to broadcast unredacted datasource credentials, including database passwords and API keys, over the Builder collaboration websocket room. This exposure occurs during external table update events such as save or delete operations. An attacker with Builder access privileges can intercept these sensitive credentials, leading to unauthorized information disclosure.

Sensitive datasource credentials including database passwords and API keys can be exposed to attackers who have access to the Builder collaboration websocket room. This can lead to unauthorized access to backend databases or APIs, compromising confidentiality and potentially enabling further attacks within the affected environment.

Upgrade Budibase Server to version 3.45.0 or later where this issue is fixed. Versions prior to 3.45.0 are vulnerable. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version range indicating the fix in 3.45.0.