Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasour…

Budibase open-source low-code platform vulnerability allows authenticated BASIC users to retrieve Snowflake private keys in plaintext. The issue occurs because the removeSecrets function only masks PASSWORD type fields but skips SENSITIVE_LONGFORM fields like Snowflake's privateKey. Authenticated users with basic permissions can exploit the GET /api/datasources/:datasourceId endpoint to access full PEM keys. The vulnerability affects versions prior to 3.38.3 and has been patched in version 3.38.3.