CVE-2026-54350: Critical NoSQL Operator Injection in Budibase Allows Unauthenticated RCE

Vulnerability Overview

CVE-2026-54350 is a critical-severity (CVSS 10.0) NoSQL operator injection vulnerability affecting @budibase/server, the backend component of the Budibase open-source low-code platform. Classified under CWE-89 (Improper Neutralization of Special Elements in Database Queries) and CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), the root cause is insufficient sanitization of user-supplied input passed into MongoDB-style query templates exposed by published Budibase applications.

Unauthenticated attackers can inject MongoDB operators — such as $gt, $regex, and the particularly dangerous $where — directly into query template parameters. Because no authentication is required to reach published-app query endpoints, the attack surface is exposed to the open internet in typical Budibase deployments. Successful exploitation can result in full database exfiltration, authentication bypass, and remote code execution via server-side JavaScript evaluation through $where clauses.

Affected Software

• Package: @budibase/server (npm)
• Affected versions: all releases prior to 3.39.12
• Vendor: Budibase (distributed via npm)

No patch has been released as of the disclosure date (2026-06-23). Organizations running any version of @budibase/server below 3.39.12 should treat their instances as actively at risk.

Exploitation Status

A public proof-of-concept (PoC) is available as of disclosure. This is not a theoretical issue — functional exploit code is circulating, meaning the time-to-exploitation window for opportunistic attackers is extremely short. The combination of a CVSS 10.0 score, unauthenticated access requirement, and public PoC places this vulnerability in the highest-urgency remediation tier. Defenders should assume active scanning and exploitation attempts are already underway against exposed Budibase instances.

Detection Coverage

The df00tech detection platform ships SIEM coverage for CVE-2026-54350 across seven platforms, giving defenders immediate visibility regardless of their security stack:

• Microsoft Sentinel (KQL) — queries targeting anomalous HTTP request patterns to Budibase published-app endpoints, focusing on parameter values containing MongoDB operator keywords ($gt, $where, $regex, etc.).
• Splunk (SPL) — searches correlating web access logs for operator-injection strings in query parameters destined for Budibase API routes.
• Elastic (EQL) — event sequence detection identifying injection attempts in HTTP body or URL parameters against known Budibase endpoint patterns.
• IBM QRadar (AQL) — AQL rules filtering network flow and application log sources for operator-injection signatures on Budibase server ports.
• Sumo Logic — log search queries targeting Budibase access logs for malformed query template parameters.
• Google Chronicle (YARAL) — UDM-based rules matching HTTP requests containing NoSQL operator tokens to Budibase application endpoints.
• CrowdStrike (CQL) — Falcon LogScale queries correlating process and network telemetry for exploitation indicators on hosts running Budibase server.

Detection logic across all platforms focuses on the presence of MongoDB operator tokens in unauthenticated HTTP requests to published-app query endpoints. High-fidelity signals include use of $where (indicating RCE intent) and rapid sequential queries with varying operator payloads (indicating automated exploitation).

Next Steps for Defenders

Prioritize upgrading @budibase/server to version 3.39.12 or later immediately. Until a patch is available or applied, consider placing Budibase instances behind an authenticated reverse proxy or restricting network access to trusted sources. Deploy the detections available on the CVE-2026-54350 detection page to gain immediate visibility into exploitation attempts across your SIEM environment.