Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasour…

CVE-2026-46427 affects Budibase, an open-source low-code platform, prior to version 3.38.3. The vulnerability exists in the removeSecrets function which only masks PASSWORD type fields but skips SENSITIVE_LONGFORM fields. This allows authenticated BASIC users to retrieve Snowflake private keys in plaintext through the GET /api/datasources/:datasourceId endpoint. The issue specifically affects Snowflake integration where private keys are typed as SENSITIVE_LONGFORM instead of PASSWORD, bypassing the security filter. The vulnerability has been fixed in Budibase version 3.38.3.