CVE-2026-46427: Budibase: Snowflake private key returned unmasked from datasource API to BASIC users

Synopsis

This is a sensitive-data exposure vulnerability in Budibase, an open-source low-code platform. The flaw is reachable over the network by any authenticated user with a basic app role, requiring no elevated privileges. Successful exploitation lets an attacker retrieve a Snowflake private key (PEM format) in plaintext from the datasource API, which can be used to authenticate directly to the victim's Snowflake account outside of Budibase. A patched-image rebuild at version 3.38.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API endpoint is exposed over the network, so an attacker must be able to reach the Budibase server via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account with a basic app role is sufficient; no admin or elevated credentials are needed beyond a valid authenticated session.

• Victim interactionNot required

  The attacker calls the datasource API directly and receives the private key in the response; no action from another user is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker issues a single authenticated GET request to a predictable endpoint to retrieve the PEM.

Blast Radius

• Reads the full Snowflake private key (PEM) in plaintext, enabling direct authentication to the target Snowflake account outside of Budibase.
• Accesses any data stored in the connected Snowflake instance using the stolen key, including tables, schemas, and stored credentials.
• Bypasses Budibase's own access controls entirely by connecting to Snowflake natively with the extracted key.