What is the CVSS score of CVE-2026-42239?

CVE-2026-42239 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Budibase are affected by CVE-2026-42239?

Budibase versions prior to 3.35.10 contain a session hijacking vulnerability that allows attackers to steal authentication tokens via JavaScript when combined with XSS attacks, enabling full account…. A patch is available.

How to fix or mitigate CVE-2026-42239?

Within 24 hours: Inventory all Budibase deployments and identify instances running versions prior to 3.35.10. Within 7 days: Upgrade all affected Budibase instances to version 3.35.10 or later. Within 30 days: Conduct security audit of Budibase configurations to ensure all authentication cookies are set with httpOnly, secure, and sameSite flags; review access logs for signs of unauthorized account access or token exfiltration.

Budibase CVE-2026-42239

EUVD-2026-28429 HIGH

Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004)

2026-05-07 GitHub_M

GHSA-4f9j-vr4p-642r

XSS Budibase

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 07, 2026 - 20:00 vuln.today

Analysis Generated

May 07, 2026 - 20:00 vuln.today

CVE Published

May 07, 2026 - 18:49 nvd

HIGH 8.1

DescriptionGitHub Advisory

Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT session token is set with httpOnly: false at packages/backend-core/src/utils/utils.ts:218. JavaScript can read this cookie via document.cookie. This means every XSS becomes a full account takeover - the attacker steals the JWT and has persistent access to the victim's account. The cookie also lacks secure: true (sent over plaintext HTTP) and sameSite attribute. This issue has been patched in version 3.35.10.

AnalysisAI

Session hijacking via JavaScript-readable authentication cookies in Budibase versions prior to 3.35.10 allows any Cross-Site Scripting (XSS) vulnerability to escalate into full account takeover. The budibase:auth cookie containing the JWT session token is set with httpOnly: false, enabling JavaScript to read it via document.cookie. Combined with confirmed prior XSS vulnerabilities in Budibase (GHSA-gp5x-2v54-v2q5), attackers can exfiltrate session tokens and gain persistent access to victim accounts. The cookie also lacks secure and sameSite flags, exposing tokens over plaintext HTTP. No public exploit identified at time of analysis. EPSS data not available. Patch available in version 3.35.10.

Technical ContextAI

The vulnerability resides in Budibase's cookie configuration at packages/backend-core/src/utils/utils.ts where the budibase:auth cookie is set without httpOnly, secure, or sameSite flags. The httpOnly flag is a critical browser security control defined in RFC 6265 that prevents JavaScript from accessing cookies through document.cookie API. Without it, cookies are exposed to any JavaScript execution context including XSS payloads, browser extensions, and injected scripts. The JWT session token stored in this cookie is the primary authentication credential for Budibase sessions. This maps to CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag), a known weakness in web application security. The affected product is cpe:2.3:a:budibase:budibase specifically the npm package @budibase/backend-core prior to version 3.35.10.

RemediationAI

Upgrade to Budibase version 3.35.10 or later where the fix has been implemented in pull request #18571 titled 'Set budibase:auth cookie with secure flag'. The patch sets httpOnly: true, secure: true, and sameSite: 'lax' on the authentication cookie. Upgrade path: npm update @budibase/backend-core to 3.35.10 or upgrade the full Budibase platform to 3.35.10. If immediate upgrade is not possible, implement compensating controls: deploy strict Content Security Policy (CSP) with 'script-src self' to block inline JavaScript and external script injection (trade-off: may break legitimate inline scripts requiring CSP nonce implementation), enable HTTPS-only access and configure HSTS headers to prevent downgrade attacks (trade-off: requires valid TLS certificates), implement Web Application Firewall (WAF) rules to detect and block XSS payloads targeting cookie exfiltration patterns (trade-off: requires tuning to avoid false positives and can be bypassed with encoding). Review and remediate any XSS vulnerabilities in the Budibase instance especially in entity name fields per GHSA-gp5x-2v54-v2q5. Vendor advisory: https://github.com/Budibase/budibase/security/advisories/GHSA-4f9j-vr4p-642r.