What is the CVSS score of CVE-2026-31816?

CVE-2026-31816 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Budibase are affected by CVE-2026-31816?

A critical vulnerability (CVSS 9.1) in Budibase allows attackers to potentially compromise internal tools, workflows, and admin panels used across your organization.

Is there a public PoC exploit available for CVE-2026-31816?

Yes, a public proof-of-concept exploit is available for CVE-2026-31816. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-31816?

Within 24 hours: Inventory all Budibase instances in your environment and assess their criticality and data exposure; isolate critical instances from production networks if possible. Within 7 days: Implement network segmentation to restrict Budibase access, enable enhanced logging/monitoring, and contact Budibase vendor for patch timeline or security guidance. Within 30 days: Execute full remediation once vendor patch is available, or evaluate alternative low-code platforms if patch timeline is unacceptable for your risk posture.

Budibase CVE-2026-31816

CRITICAL

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-09 security-advisories@github.com

CSRF Budibase

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Mar 13, 2026 - 17:33 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 21:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() middleware immediately calls return next(), skipping all authentication, authorization, role checks, and CSRF protection. This means a completely unauthenticated, remote attacker can access any server-side API endpoint by simply appending ?/webhooks/trigger (or any webhook pattern variant) to the URL.