Advisory · CVE-2026-100683
Budibase column rename turns a column name into SQL injection
Budibase before 3.45.0 builds MySQL and MSSQL column-rename DDL by interpolating identifiers directly into a raw query string without applying its identifier-quoting helpers. An attacker with DDL rights on a connected datasource can create a column whose name contains a backtick or quote plus SQL; when a builder later renames that column through the UI, the embedded quote terminates the identifier and the injected SQL runs as the Budibase datasource user (MySQL connections allow stacked statements), enabling arbitrary reads, writes, or destructive operations outside Budibase's permission model. Fixed in 3.45.0.
- Vendor
- Budibase
- Product
- Budibase
- Identifier / CWE
- CVE-2026-100683
CWE-89 - Action timing
- Immediate
Explain it like I’m five
The librarian writes a book's new title straight into the official order form without quotes. A prankster titles a book with a phrase that closes the title box early and adds their own orders, which the system then executes as the librarian.
- 01Poisoned column name
An attacker with DDL rights on a connected datasource creates a column whose name contains a backtick or quote plus SQL.
- 02UI rename
A builder later renames that column through the Budibase UI.
- 03Raw interpolation
The rename DDL interpolates the identifier directly into a raw query string with no quoting.
- 04Injected SQL runs
The embedded quote terminates the identifier and the injected SQL executes as the Budibase datasource user.
What happened
Budibase before 3.45.0 builds MySQL and MSSQL column-rename DDL by interpolating identifiers directly into a raw query string without applying its identifier-quoting helpers (CVE-2026-100683, CVSS 8.9). An attacker with DDL rights on a connected datasource can create a column whose name contains a backtick or quote plus SQL; when a builder later renames that column through the UI, the embedded quote terminates the identifier and the injected SQL runs as the Budibase datasource user. MySQL connections allow stacked statements, enabling arbitrary reads, writes, or destructive operations outside Budibase’s permission model. The issue is fixed in Budibase 3.45.0.
What to do
- Upgrade Budibase to 3.45.0 or later.
- Audit connected datasources for columns with unusual names containing quotes or backticks.
- Review database query logs for unexpected statements originating from the Budibase datasource user.
- Apply least privilege to the Budibase datasource database user so a future injection has less to work with.
Management note
Second-order SQL injection, where the payload is planted in a name and detonated by an innocent admin action later, is exactly the kind of thing code review misses and quoting helpers exist to prevent. The helpers were there; this one query just did not use them.