CVE-2026-5418
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In appsmithorg appsmith up to version 1.97, there is a server-side request forgery (SSRF) vulnerability in the computeDisallowedHosts function in WebClientUtils.java in the Dashboard component. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
An attacker can send requests to internal network resources, potentially leading to disclosure of sensitive data or further system compromise.
Recommendation
Upgrade appsmith to version 1.99 or later.
Other vulnerabilities in appsmith
See all- CVE-2026-22794Critical
Vulnerability in Appsmith before 1.93: the server uses the Origin header value as the email link baseUrl without validation. An attacker controlling Origin can cause password reset / email verification links to point to their domain, exposing authentication tokens and potentially leading to account takeover.
- CVE-2026-49979Low
In Appsmith prior to version 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration.
- CVE-2026-7299Medium
Appsmith's SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
- CVE-2026-34411Medium
A vulnerability in Appsmith versions prior to 1.98 exposes sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains.
Original NVD description (English source)
A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.