CVE-2026-46427
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-200
Revelación de información
Fecha de publicación:
27/05/2026
Última modificación:
27/05/2026
Descripción
*** Pendiente de traducción *** Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource config fields whose schema type is DatasourceFieldType.PASSWORD. The Snowflake integration types its privateKey field as SENSITIVE_LONGFORM, which the filter skips. GET /api/datasources/:datasourceId lives on authorizedRoutes guarded by PermissionType.TABLE + PermissionLevel.READ. An authenticated BASIC user with any app role and call the endpoint and receive the full Snowflake PEM in plaintext. This vulnerability is fixed in 3.38.3.
Impacto
Puntuación base 3.x
7.70
Gravedad 3.x
ALTA