CVE-2026-54350: Budibase: Anonymous NoSQL operator injection via published-app query templates

Synopsis

NoSQL operator injection in Budibase, an open-source low-code platform, allows an unauthenticated attacker to reach the query execution endpoint over the network with no credentials required. By supplying a crafted parameter value that breaks out of the JSON template substitution, an attacker can lift arbitrary MongoDB or CouchDB operators into the parsed filter object. Successful exploitation gives the attacker full read access to every document in the backing database collection and, where a PUBLIC write query has been published, full write access to every document in that collection. A patched-image rebuild at version 3.39.12 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint POST /api/v2/queries/:queryId is exposed over the network; an attacker must be able to reach the published Budibase app's HTTP interface to exploit this vulnerability.

• AuthenticationNot required

  The authorized middleware short-circuits for PUBLIC-role queries, and no session or credential is required; only the publicly visible x-budibase-app-id header is needed.

• Victim interactionNot required

  The attacker sends a single crafted HTTP request directly to the API endpoint; no user action, click, or browser visit by a victim is involved.

• Attack complexityDetail

  The exploit is reliable and condition-free; breaking out of the JSON template requires only a well-formed parameter string, with no race condition, memory layout dependency, or special environmental state needed.

Blast Radius

• Reads every document stored in the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection that the published app is connected to, including records belonging to all application users.
• Where the builder has published a PUBLIC write query, overwrites every document in the targeted collection in a single HTTP request using the builder-defined $set body applied collection-wide.
• Because the CVSS scope token is Changed, the impact extends beyond the Budibase server process itself to the underlying database service and any downstream systems that consume or replicate that data.
• CSRF is not enforced on the affected path, so the injection can be triggered from any origin without additional preconditions.