CVE-2026-72851 is an unauthenticated SQL injection vulnerability in Budibase server versions before 3.40.0. The flaw exists in webhook-triggered automations that use EXECUTE_QUERY steps, allowing attackers to POST attacker-controlled JSON to the webhook trigger endpoint. This input is improperly neutralized, enabling SQL payload injection that executes with builder-configured database credentials. This can result in unauthorized data exfiltration, modification, and persistence in connected datasources such as Snowflake. The vulnerability is rated critical with a CVSS 4.0 score of 9. The affected product is a cloud service, and the vendor typically manages remediation for such services.

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL commands on connected databases with the privileges of the builder-configured credentials. This can lead to unauthorized data disclosure, data modification, and persistent changes in connected datasources like Snowflake. The impact is critical due to the potential for full compromise of sensitive data.

A patch is available for Budibase server versions prior to 3.40.0. Since Budibase is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated to version 3.40.0 or later to ensure the vulnerability is mitigated.