CVE-2026-31816— Budibase Universal Auth Bypass via Webhook Query Param Injection
Quick assessment
Affected
Budibase budibase
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Budibase是英国Budibase开源的一个用于在几分钟内创建内部应用程序、工作流和管理面板的低代码平台。 Budibase 3.31.4及之前版本存在注入漏洞，该漏洞源于authorized()中间件可通过在查询字符串中附加webhook路径模式被完全绕过，可能导致未经身份验证的远程攻击者访问任何服务器端API端点。
Public Exploits 1
Nuclei · 1
CVE-2026-31816.yaml [template]
In-the-Wild Activity Observed
github_trending · low
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-31816
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Budibase Universal Auth Bypass via Webhook Query Param Injection
Source: CVE Program / CVE List V5
Vulnerability Description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() middleware immediately calls return next(), skipping all authentication, authorization, role checks, and CSRF protection. This means a completely unauthenticated, remote attacker can access any server-side API endpoint by simply appending ?/webhooks/trigger (or any webhook pattern variant) to the URL.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Budibase 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Budibase是英国Budibase开源的一个用于在几分钟内创建内部应用程序、工作流和管理面板的低代码平台。 Budibase 3.31.4及之前版本存在注入漏洞，该漏洞源于authorized()中间件可通过在查询字符串中附加webhook路径模式被完全绕过，可能导致未经身份验证的远程攻击者访问任何服务器端API端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2026-31816
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | https://github.com/vulhub/vulhub/blob/master/budibase/CVE-2026-31816/README.md | POC Details | |
| 2 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Budibase%20Webhook%20%E6%9F%A5%E8%AF%A2%E5%8F%82%E6%95%B0%E8%AE%A4%E8%AF%81%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E%20CVE-2026-31816.md | POC Details |
| 3 | Budibase <= 3.31.4 contains an authentication bypass caused by unanchored regex in authorized() middleware matching webhook path patterns in query strings, letting unauthenticated remote attackers access any server-side API endpoint, exploit requires crafted request with webhook pattern in URL. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31816.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-31816
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-31816 (1)
Same Patch Batch · Budibase · 2026-03-09 · 5 CVEs total
| CVE-2026-30240 | 9.6 CRITICAL | Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All |
| CVE-2026-25737 | 8.9 HIGH | Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored |
| CVE-2026-25045 | Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Cr | |
| CVE-2026-25041 | Budibase has a Command Injection in PostgreSQL Dump Command |
IV. Related Vulnerabilities
Same product: budibase
-
CVE-2026-103757
Budibase before 3.41.0 SSRF via uploadUrl in AI Table Genera -
CVE-2026-54356
Budibase authenticated arbitrary S3 signed upload URL issuan -
CVE-2026-35219
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, S -
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource inte -
CVE-2026-64657
Budibase: Database Connector SQL Injections in PostgreSQL, M
Same vendor: Budibase
-
CVE-2026-103757
Budibase before 3.41.0 SSRF via uploadUrl in AI Table Genera -
CVE-2026-100688
Budibase server before 3.45.0 Cross-Tenant Information Discl -
CVE-2026-100686
Budibase before 3.45.0 Cross-Workspace Privilege Escalation -
CVE-2026-100687
Budibase Server before 3.45.0 Credential Exposure via Extern -
CVE-2026-100685
Budibase before 3.45.0 Information Disclosure via Chat Links
Same weakness: CWE-74
-
CVE-2026-88094
Azure Storage Library Elevation of Privilege Vulnerability -
CVE-2026-109961
Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add -
CVE-2026-109275
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code In -
CVE-2026-102291
Kirki – Freeform Page Builder, Website Builder & Customizer -
CVE-2026-76472
Cisco Meraki Security Hardening Release October 2026 - Impro
V. Comments for CVE-2026-31816
No comments yet