CVE-2026-41428 - Vulnerability Analysis

Overview

Budibase < 3.35.4 contains an authentication bypass caused by unanchored regex matching of public endpoint patterns against ctx.request.url including query strings, letting attackers access protected endpoints by appending public paths as query parameters, exploit requires attacker to be authenticated.

Severity & Score

Impact

Authenticated attackers can bypass authentication to access protected endpoints, potentially exposing sensitive data or functionality.

Mitigation

Update to version 3.35.4 or later.

References

• https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 24, 2026

🔴 CVE-2026-41428 - Critical (9.1) Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query st... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41428/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner