CVE-2026-72851 is an unauthenticated SQL injection vulnerability affecting Budibase server versions before 3.40.0. The issue arises in webhook-triggered automations that include EXECUTE_QUERY steps, where attacker-controlled JSON POSTed to the webhook endpoint can inject SQL payloads. These payloads execute with the database credentials configured by the builder, allowing attackers to exfiltrate, modify, or persist data in connected datasources such as Snowflake. The vulnerability is critical with a CVSS 4.0 score of 9, reflecting high impact and attack complexity. The product is a cloud service, and the vendor typically manages patching on the server side.

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL commands on connected datasources with builder-configured credentials. This can lead to unauthorized data exfiltration, data modification, and persistence of malicious data within the affected databases. The impact is critical due to the potential for full compromise of connected data sources.

A patch is available for Budibase server versions prior to 3.40.0. Since Budibase is a cloud service, the vendor manages remediation on the server side. Users should verify with the vendor advisory that their environment has been updated to version 3.40.0 or later to mitigate this vulnerability.