Budibase CVE-2026-82244

Exploitation requires an authenticated Budibase administrator account (CVSS PR:H) and the ability to reach the server's plugin upload functionality over the network (AV:N); the specific trigger is uploading a malicious plugin tarball containing JavaScript, which the server executes via unsandboxed eval() in its main Node.js process. Full host and credential compromise as described depends on the default deployment mode where that Node.js process runs with root privileges - a hardened, non-root deployment limits impact. The key limiting factor is the administrator privilege requirement: this is not remotely exploitable by unauthenticated attackers, so realistic risk hinges on how well admin accounts are controlled and monitored. No user interaction from a victim is needed (UI:N).

The signals are largely consistent and point to a high-priority, high-impact bug tempered by a meaningful access barrier. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with all impact metrics High and subsequent-system impacts High, score 9.4) reflects network reachability and complete compromise, but PR:H means the attacker must already hold administrator privileges - so this is a privilege-escalation-to-host / insider-or-compromised-admin scenario rather than an anonymous internet exploit. There is no CISA KEV listing and no public POC noted, and no EPSS value was provided, so exploitation probability cannot be quantified from the input; the absence of a scored EPSS should not be read as low risk. Given root-level execution and credential exfiltration in default deployments, any operator running a self-hosted Budibase instance should treat this as urgent and patch promptly, especially where admin access is broadly granted or where the same instance holds production secrets. The main mitigating factor is that trust in the admin role is the gate - organizations that tightly control and monitor admin accounts face lower realistic exposure than those with shared or loosely governed admin access.

An attacker who has obtained Budibase administrator access - through phishing, credential reuse, or an insider - crafts a plugin tarball whose JavaScript reads process.env and posts the server's secrets to an attacker-controlled endpoint, then uploads it through the normal plugin interface. The server evaluates the plugin code via eval() in its root-privileged Node.js process, executing the attacker's payload and exfiltrating credentials. No public POC is noted, but exploitation is straightforward once admin access is held given AC:L and no user interaction required.