CVE-2026-72851

The CVSS 10 rating here is misleading, and you should not let it drive your prioritization in the usual way. The EPSS score of 0.00286 tells the real story: automated mass exploitation of this vector is effectively nonexistent, and for good reason. This is not a universal SQL injection in an application's authentication flow — it requires a specific automation workflow where a builder has already configured an EXECUTE_QUERY step, and the attacker needs to reach it through an automation webhook. In most properly hardened deployments, that webhook is network-isolated, behind an auth proxy, or simply too obscure for automated scanners to find. What should actually concern you is the persistence and lateral movement vector through connected datasources, particularly Snowflake. When this SQL injection fires, it executes with whatever datasource privileges the Budibase application connection already holds. In enterprise deployments, that service account frequently has cross-account access or elevated read-write permissions precisely because a builder configured it for convenience, not least privilege. The attacker does not need to establish their own persistence mechanism — they inherit your organization's existing trust topology. They get immediate operational access to every datasource Budibase already talks to, with credentials already provisioned and connections already established. This creates a fundamental detection problem. Your security tooling sees Budibase making legitimate calls to Snowflake. It sees scheduled automations running SQL queries. It cannot reliably distinguish between a builder-configured query and a payload-injected query operating through the same channel, with the same credentials, during the same automation window. The attack surface and the legitimate workflow are indistinguishable by design. The low EPSS score almost certainly reflects low automation maturity for this specific chain, not genuine low exploitation likelihood. Mass scanners cannot enumerate the automation endpoint, understand the JSON injection format, and chain it with knowledge of connected datasources. But any attacker who has done targeted recon on your Budibase deployment — which is often trivially enumerable through /.well-known/budibase endpoints — can execute it reliably. The EPSS/CVSS gap is not reassurance; it is a measure of how narrow the population of automated exploiters is, not how narrow the population of targeted attackers is. One final note: the CVE is dated 2026, which raises legitimate questions about whether this is a placeholder, a test artifact, or a genuine disclosure that shipped without public notation. If it was found in an audit rather than reported externally, organizations on older versions may have no signal that they should update. Treat the date with skepticism and verify provenance before treating this as a routine patch cycle. Your priority actions: audit which automation workflows in your Budibase instance include EXECUTE_QUERY steps, review the privilege scope of any connected Snowflake or datasource service accounts, and implement query-level anomaly detection that can flag unexpected query patterns from Budibase identities — not just credential-level monitoring.

Reviewed through automated stages and approved by a human before publication.