CVE-2026-64657 is a SQL injection vulnerability in Budibase's PostgreSQL datasource connector. When an administrator configures a PostgreSQL datasource and supplies a schema name, that value is injected directly into a SET search_path statement without escaping embedded double quotes. PostgreSQL permits double quotes around identifiers, so a schema name like my"schema breaks out of the intended identifier context and allows arbitrary SQL execution.
The vulnerability affects Budibase versions prior to 3.39.19. The fix is straightforward — double quotes within the schema name must be escaped by doubling them (the standard PostgreSQL identifier escaping rules). However, the deeper issue is that this pattern of injecting configuration values into SQL contexts that don't support parameterization is not isolated to this connector.
What makes this worth your attention is the low-code platform context. The 'authenticated administrator' account required for exploitation isn't necessarily a security professional — it's often a business analyst or citizen developer given admin rights to configure datasources for the applications they're building. These users may understand their domain deeply but lack the mental model that typing a schema name is equivalent to writing SQL that will execute against your production database. The abstraction that makes low-code platforms productive is simultaneously hiding a technical attack surface that would be obvious to a traditional DBA.
Check your Budibase deployment: verify you're on 3.39.19 or later, and audit which datasource connectors are in use. The PostgreSQL connector is now fixed, but the MySQL, MongoDB, Redis, and other connectors in Budibase were written by the same team under the same assumptions — configuration fields interpolated into SQL contexts without parameterized queries. There's no evidence these have been audited for the same class of flaw. The pattern of 'user-supplied configuration value → interpolate into SQL' is the path of least resistance, and it's the same failure that has surfaced in Hibernate, Sequelize, Knex, and numerous application frameworks over the past decade.
If you're running Budibase in production, treat the upgrade to 3.39.19 as urgent not because this specific flaw is likely being exploited, but because the low-code platform upgrade cycle means your instance may be months behind current releases — and each month you run unpatched is a month where any administrator with datasource configuration access can execute arbitrary SQL against whatever database that datasource connects to.