NVD has published CVE-2026-82244, a critical vulnerability carrying a CVSS v3.1 score of 9.1 with a NETWORK attack vector. While the NVD entry is categorized under Node.js — the runtime in which the flaw manifests — the vulnerable component at the heart of this advisory is Budibase, the popular open-source low-code platform. All Budibase versions prior to 3.41.3 contain an unauthenticated-code-execution-class flaw in plugin handling that allows an authenticated administrator to execute arbitrary code on the server simply by uploading a malicious plugin tarball.
If you run Budibase — self-hosted, in Docker, or embedded in an internal tooling stack — this is a patch-now situation. The vulnerable code path calls eval() on plugin JavaScript files with no sandboxing, and it executes inside the main Node.js process. In default deployments, that process runs with access to every environment variable on the host — database connection strings, cloud provider credentials, API keys, JWT secrets — and in many containerized installs, it runs as root. A single malicious plugin upload equals full credential exfiltration and host compromise.
Why the "authenticated admin" caveat should not lower your guard: low-code platforms like Budibase are frequently deployed with weak or default admin credentials, shared admin accounts, or admin roles handed to non-security staff for app building. Admin compromise via credential stuffing, phishing, or an insider turns this vulnerability into instant remote code execution. Treat it as such.
Technical Analysis
Affected Products and Versions
| Component | Affected Versions | Fixed Version |
|---|---|---|
| Budibase (self-hosted / Docker / OSS) | All versions before 3.41.3 | 3.41.3 and later |
The vulnerability lives in Budibase's plugin handling subsystem, which allows administrators to upload custom plugins packaged as tarballs (.tar.gz) containing JavaScript that extends Budibase functionality.
How the Vulnerability Works
From a defender's perspective, the attack chain is short and devastating:
- Authentication: The attacker holds valid Budibase admin credentials — obtained through phishing, credential reuse, default credentials, or a malicious insider.
- Plugin Upload: The attacker crafts a plugin tarball containing a malicious JavaScript file and uploads it through the admin plugin management interface over the network.
- Unsafe Evaluation: The Budibase server extracts the plugin and passes the plugin's JavaScript directly to
eval()inside the main Node.js process — no sandbox, no VM isolation, no seccomp boundary, no restricted require context. - Code Execution: The attacker's code executes with the full privileges of the Budibase server process. In default Docker deployments this is frequently root inside the container, and the process environment contains the crown jewels:
DATABASE_URL, object-storage keys, SMTP credentials, internal API tokens, and SSO secrets. - Exfiltration / Post-Exploitation: Because the code runs in-process, the attacker can read
process.env, load arbitrary Node modules (child_process,fs,net), spawn shells, pivot to the container host if the runtime is misconfigured, and exfiltrate data over egress channels that look like ordinary application traffic.
The core design failure — executing uploaded third-party code via eval() in the primary application process — violates the most basic tenant of plugin architecture: untrusted extensions must run in an isolated context. This is the same class of weakness that has driven supply-chain compromises across the low-code and CI/CD ecosystem, and it is why plugin and extension marketplaces remain a high-value target for threat actors in 2025–2026.
Exploitation Status
At the time of publication, CVE-2026-82244 has been published by NVD with a CVSS 9.1 rating. Given the trivial exploitability — a working exploit requires only admin credentials and a tarball with a few lines of JavaScript — defenders should assume rapid PoC availability and treat any internet-exposed Budibase instance as an imminent target. Check CISA's Known Exploited Vulnerabilities catalog for updates and monitor Budibase's GitHub security advisories for exploitation reporting.
Detection & Response
The highest-fidelity detection opportunities center on three behaviors: plugin tarball uploads to the Budibase admin API, the Budibase Node.js process spawning child processes or shells, and unexpected egress from the Budibase host.
Sigma Rules
---
title: Budibase Node.js Process Spawning Shell or System Utilities
id: 8c2f4a91-3b7e-4d12-9f6a-5e1c7b8d2a44
status: experimental
description: Detects the Budibase server Node.js process spawning shells, interpreters, or post-exploitation utilities — consistent with malicious plugin code executing via eval() in the main process (CVE-2026-82244).
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-82244
- https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/node'
- '/nodejs'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/python'
- '/python3'
- '/perl'
- '/curl'
- '/wget'
- '/nc'
- '/ncat'
- '/netcat'
- '/base64'
- '/env'
- '/printenv'
filter_workdir:
WorkingDirectory|contains:
- '/usr/lib/node_modules/npm'
- '/root/.npm'
condition: selection_parent and selection_child and not filter_workdir
falsepositives:
- Budibase apps or plugins legitimately invoking system commands (rare in production)
- Node-based build tooling on developer workstations (restrict scope to Budibase server hosts)
level: high
---
title: Node.js Process Reading Sensitive Credential or Environment Files
id: 1f7b3d55-9e42-4a68-b2c1-7d4e6f9a0c33
status: experimental
description: Detects the Budibase Node.js process accessing cloud credential files, SSH keys, or environment files — a hallmark of post-exploitation credential harvesting following malicious plugin eval() execution (CVE-2026-82244).
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-82244
- https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.credential_access
- attack.t1552.001
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|endswith:
- '/node'
- '/nodejs'
selection_files:
TargetFilename|contains:
- '/.aws/credentials'
- '/.azure/'
- '/.config/gcloud/'
- '/.ssh/id_'
- '/etc/shadow'
- '/.env'
- '/run/secrets/'
- '/var/run/secrets/'
condition: selection_process and selection_files
falsepositives:
- Budibase legitimately loading its own .env configuration at startup (tune to exclude startup window or known config paths)
level: high
---
title: Budibase Plugin Tarball Upload Followed by Archive Extraction
id: 3e9a1c74-5f28-4b93-a7d6-2c8b4e1f6d55
status: experimental
description: Detects plugin tarball files written to Budibase plugin directories and subsequent tar extraction activity, indicating a plugin installation event that should be correlated with authorized change tickets (CVE-2026-82244).
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-82244
- https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.initial_access
- attack.t1195.002
logsource:
category: file_event
product: linux
detection:
selection_ext:
TargetFilename|endswith:
- '.tar.gz'
- '.tgz'
selection_path:
TargetFilename|contains:
- '/budibase/'
- '/plugins/'
condition: selection_ext and selection_path
falsepositives:
- Legitimate plugin installations by administrators — alert should be correlated with change management records rather than auto-blocked
level: medium
KQL (Microsoft Sentinel / Defender)
This query hunts for the Budibase Node.js process spawning child processes or shells — the primary post-exploitation signal — using Syslog/CEF-ingested Linux audit data as well as Defender for Endpoint telemetry where Budibase runs on a managed host.
// Hunt: Budibase Node.js process spawning shells or post-exploitation tools (CVE-2026-82244)
let Lookback = 7d;
let SuspiciousChildren = dynamic(["/bin/sh","/bin/bash","/bin/dash","/usr/bin/curl","/usr/bin/wget","/bin/nc","/usr/bin/python3","/usr/bin/env","/usr/bin/printenv","/usr/bin/base64"]);
union isfuzzy=true
(
Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName =~ "node" or SyslogMessage has "node"
| where SyslogMessage has_any ("sh", "bash", "curl", "wget", "nc ", "python", "printenv", "child_process")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
),
(
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ ("node", "nodejs")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python3", "env", "printenv", "base64")
or ProcessCommandLine has_any ("/bin/sh", "/bin/bash", "curl http", "wget http", "printenv", "/.aws/credentials")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
)
| order by TimeGenerated desc
Velociraptor VQL
This artifact hunts live Budibase hosts for Node.js processes that have spawned suspicious child processes or hold command lines referencing plugin extraction or environment access.
-- Hunt for Budibase Node.js processes with suspicious children or command lines (CVE-2026-82244)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)node'
AND (
CommandLine =~ '(?i)(plugin|tar|eval|child_process|\.env|credentials)'
OR Ppid IN (
SELECT Pid FROM pslist()
WHERE CommandLine =~ '(?i)(/bin/sh|/bin/bash|curl |wget |nc |printenv)'
)
)
Remediation and Verification Script (Bash)
Run this on self-hosted Budibase hosts (or against your container images) to verify the running version, check for signs of plugin-based compromise, and confirm egress exposure. Adapt paths to your deployment layout.
#!/bin/bash
# CVE-2026-82244 - Budibase plugin eval() RCE verification & triage script
set -u
echo "=== [1] Identify Budibase version ==="
# Docker deployments: check the running image tag
docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -i budibase || echo "No Budibase container found via docker ps"
# Bare-metal / package installs: check package.json if present
find / -maxdepth 6 -path '*budibase*package.json' 2>/dev/null | head -5 | while read -r f; do
echo "Found: $f"; grep -m1 '"version"' "$f"
done
echo ""
echo "=== [2] Flag any Budibase version below 3.41.3 (VULNERABLE) ==="
docker images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -i budibase | while read -r img; do
ver=$(echo "$img" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
if [ -n "$ver" ]; then
if [ "$(printf '%s\n3.41.3\n' "$ver" | sort -V | head -1)" != "3.41.3" ] && [ "$ver" != "3.41.3" ]; then
echo "VULNERABLE: $img (version $ver < 3.41.3) — UPGRADE IMMEDIATELY"
else
echo "OK: $img (version $ver)"
fi
fi
done
echo ""
echo "=== [3] Inventory installed plugins (look for anything not in change records) ==="
find / -maxdepth 7 -type d -name 'plugins' -path '*budibase*' 2>/dev/null | while read -r d; do
echo "Plugin dir: $d"; ls -lat "$d" | head -20
done
echo ""
echo "=== [4] Check for node processes spawning shells (post-exploitation indicator) ==="
ps auxww | grep -E 'node' | grep -v grep | awk '{print $2}' | while read -r pid; do
children=$(ps --ppid "$pid" -o comm= 2>/dev/null | tr '\n' ' ')
if echo "$children" | grep -qE '(sh|bash|curl|wget|nc|python|perl)'; then
echo "ALERT: node PID $pid has suspicious children: $children"
fi
done
echo ""
echo "=== [5] Audit recent egress connections from Budibase containers ==="
docker ps --format '{{.Names}}' 2>/dev/null | grep -i budibase | while read -r c; do
echo "--- $c ---"
docker exec "$c" sh -c "netstat -tunp 2>/dev/null | grep ESTABLISHED | head -20" 2>/dev/null || echo "(netstat unavailable in container)"
done
echo ""
echo "=== [6] Check whether Budibase process runs as root (default = YES in most images) ==="
docker ps --format '{{.Names}}' 2>/dev/null | grep -i budibase | while read -r c; do
echo "$c running as: $(docker exec "$c" id -u -n 2>/dev/null || echo unknown)"
done
echo ""
echo "DONE. If any ALERT lines appear, isolate the host and initiate IR procedures."
Remediation
- Upgrade Budibase to version 3.41.3 or later immediately. This is the only complete fix. Pull the updated container image or apply the release per the official Budibase GitHub repository and security advisories and the NVD entry for CVE-2026-82244. Verify the running version post-upgrade using the script above — image tags and actually-running containers frequently drift apart.
- Rotate all credentials accessible to the Budibase process. If you were running a vulnerable version with plugins installed — especially any plugin not traceable to a change ticket — assume
process.envwas readable. Rotate database passwords, cloud keys, API tokens, SMTP credentials, and SSO secrets. Do this after patching and after reviewing for persistence. - Audit installed plugins against change records. Any plugin tarball present on the server that cannot be tied to an authorized installation must be treated as a compromise: preserve it as evidence, hash it, and initiate DFIR.
- Lock down admin access. Enforce MFA (or SSO with conditional access) on all Budibase admin accounts, eliminate shared admin credentials, restrict the admin panel to an allowlisted network segment or VPN, and review admin account creation logs.
- Remove Budibase from direct internet exposure. A low-code builder admin console has no business being reachable from the open internet. Place it behind a reverse proxy with authentication, or restrict to internal networks.
- Harden the runtime. Run the Budibase container as a non-root user, drop unnecessary Linux capabilities, apply a restrictive seccomp/AppArmor profile, and enforce egress filtering so the server can only reach required upstreams. These controls convert a full compromise into a contained one.
- Monitor CISA KEV. Track whether CVE-2026-82244 is added to the Known Exploited Vulnerabilities catalog, which would impose a federal remediation deadline and signal confirmed in-the-wild abuse.
The broader lesson: any platform feature that uploads and executes code — plugins, extensions, custom functions, workflow scripts — is a privileged code-execution pathway wearing an "admin feature" costume. Inventory every such feature in your environment, gate it behind strong authentication and change control, and monitor the hosting process for child-process and egress anomalies. That posture protects you not just from CVE-2026-82244, but from the next plugin-architecture flaw that follows it.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.