Unauthenticated SQL injection in Budibase webhook automations (CVE-2026-72851)

Budibase automation webhook endpoints are unauthenticated by design, allowing any attacker who knows a webhook's (instance, id) pair to POST attacker-controlled JSON that is spliced into EXECUTE_QUERY step bindings and executed with builder-configured database credentials, enabling SQL injection against connected datasources such as Snowflake. In enterprise Pro deployments with synchronous automations enabled, automations containing a COLLECT step additionally return EXECUTE_QUERY output directly in the HTTP response, creating an unauthenticated data-exfiltration channel. Webhook identifiers are routinely embedded in third-party service configurations where they may be exposed via screenshots, exported configs, or compromised integrations. Affected versions: - <3.40.0 We recommend updating to: 3.40.0. CVSS 9.0 · our assessment: act_now Reference: https://github.com/Budibase/budibase/security/advisories/GHSA-x7h8-ww3q-xv7c Details: https://vuln.today/cve/CVE-2026-72851