Budibase CVE-2026-35216: Overview of Unauthenticated RCE via Webhook and Bash Automation

Introduction

An unauthenticated remote code execution flaw in self-hosted Budibase deployments lets any external attacker run arbitrary commands as root inside the application container, without credentials. The attack chains a publicly accessible webhook endpoint with the platform's Bash automation step, so a legitimate low-code feature becomes a direct OS command injection sink.

Budibase is an open-source, low-code platform for building internal business applications. It was founded in Belfast in 2019. The company reports that over 200,000 teams use its toolkit, and the self-hosting option is a core selling point for organizations with strict data privacy requirements. Because Budibase connects to backend databases like Postgres and MySQL and runs sensitive internal tooling, a root-level RCE in it has serious consequences for its users.

Technical Information

CVE-2026-35216 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and carries a CVSS base score of 9.0. The vulnerability chains two distinct components in the Budibase architecture: an unauthenticated public webhook endpoint, and the Bash automation step's unsanitized use of Handlebars template substitution before it passes input to execSync().

The Unauthenticated Webhook Endpoint

The webhook trigger endpoint, located at packages/server/src/api/routes/webhook.ts, is registered on public routes with no authentication middleware. This is by design, because webhooks exist to receive external events. It also means any unauthenticated HTTP client can send a POST request to the endpoint and trigger the associated automation workflow.

The Command Injection Sink

The vulnerable code path is in the Bash automation step at packages/server/src/automations/steps/bash.ts. When an automation is triggered, the application runs Handlebars template processing on the Bash step's code field. Values from the webhook request body are flattened into the automation context and substituted directly into the shell command string. The application then passes the resulting string to Node.js's execSync() function for execution.

The webhook payload fields flow into the Handlebars template without sanitization or escaping, so an attacker can embed arbitrary OS commands in the request body, and execSync() evaluates and executes them.

Attack Flow

Exploitation proceeds in these steps:

1. The attacker identifies a self-hosted Budibase instance where an administrator has created and published an automation containing a Webhook trigger connected to a Bash step.
2. The Bash step's code field references a trigger field template, which is a Handlebars expression that pulls a value from the incoming webhook payload.
3. The attacker sends a crafted POST request to the public webhook endpoint. The request body carries a malicious OS command in the field that the Bash step's template references.
4. Budibase processes the webhook, substitutes the attacker-controlled value into the Bash step's code via Handlebars, and passes the resulting string to execSync().
5. The injected command executes as root inside the container.

Preconditions

The attack chain is viable only when all three of these conditions hold:

• The deployment is self-hosted. The Bash step is only registered when the self-hosted environment variable is active.
• An administrator has created and published an automation containing a Webhook trigger and a Bash step.
• The Bash step's code field uses a trigger field template that references data from the webhook payload.

Impact

Successful exploitation gives the attacker root-level command execution inside the container. From there, the attacker can run arbitrary OS commands, exfiltrate sensitive secrets (database credentials, JWT secrets, API keys, storage keys), move laterally to internal services reachable from the container, and potentially escape the container if privileged mounts or flags are configured.

Affected Systems and Versions

Only self-hosted Budibase deployments are affected, because the Bash automation step is only registered when the self-hosted environment variable is active. Budibase Cloud instances are not vulnerable to this specific attack vector.

The vulnerability also requires that an administrator has created and published an automation combining a Webhook trigger with a Bash step that uses trigger field templates.

Vendor Security History

Budibase disclosed multiple high- and critical-severity vulnerabilities in early 2026:

With three disclosures this close together, organizations running self-hosted Budibase instances should patch proactively rather than wait. Administrators should subscribe to Budibase's GitHub security advisories to hear about future disclosures.

References

• NVD Entry for CVE-2026-35216
• GitHub Security Advisory GHSA-fcm4-4pj2-m5hf
• Patch Commit: f0c731b
• Pull Request #18238: Fix bash automation command injection
• Budibase Release 3.33.4
• NVD Entry for CVE-2026-25040
• NVD Entry for CVE-2026-33226