{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.38.1"}],"component":"@budibase/server","cve_ids":["CVE-2026-73407"],"ecosystem":"npm","epss":0.0054,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-mqhr-6j6h-74p5","id":"tcs_01M5KG1GM6Y0JTTV5WAM6S46B2","modified_at":"2026-08-13T04:11:10.425225151Z","published_at":"2026-07-24T21:22:51Z","references":["https://osv.dev/vulnerability/GHSA-mqhr-6j6h-74p5","https://github.com/Budibase/budibase/security/advisories/GHSA-mqhr-6j6h-74p5","https://github.com/Budibase/budibase/pull/19239","https://github.com/Budibase/budibase/commit/8b1bca71501b11c68310351ef4f2c3028b2d5f08","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.40.1"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-mqhr-6j6h-74p5","url":"https://osv.dev/vulnerability/GHSA-mqhr-6j6h-74p5"},{"source":"nvd","source_id":"CVE-2026-73407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73407"}],"summary":"Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak"}