CVE-2026-31816:

Critical authentication bypass vulnerability in Budibase server allows unauthenticated access to all API endpoints.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.1Critical

Published Date:Mar 9, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:9.1
EPSS Percentile:93%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.2
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:NONE

Description Preview

Critical authentication bypass vulnerability in Budibase server allows unauthenticated access to all API endpoints.

Overview

The vulnerability in Budibase (CVE-2026-31816) is a critical security flaw with a CVSS v3.1 base score of 9.1. It allows attackers to bypass all security checks on the server, potentially leading to unauthorized access to sensitive data and system compromise. The attack vector is network-based, requires no privileges or user interaction, and has a low attack complexity. This vulnerability significantly impacts the confidentiality and integrity of the affected systems, although it does not directly affect availability. The weakness is categorized as CWE-74, which relates to improper neutralization of special elements in output used by a downstream component to interpret or execute code.

Remediation

To address this vulnerability, users of Budibase should immediately upgrade to a version newer than 3.31.4. System administrators should also implement additional security measures such as:
1. Implementing strong network segmentation to limit access to Budibase servers.
2. Utilizing Web Application Firewalls (WAF) to filter malicious requests.
3. Monitoring system logs for suspicious activities, particularly focusing on unexpected API access patterns.
4. Conducting a thorough security audit of all Budibase installations to ensure no unauthorized access has occurred.
5. Reviewing and potentially resetting all user credentials and access tokens as a precautionary measure.
Organizations using Budibase should also reassess their overall security posture and consider implementing additional layers of authentication and authorization for critical systems and data.