CVE-2026-34411
Unauthenticated Access to Appsmith API Exposes Sensitive Data
Publication date: 2026-03-27
Last updated on: 2026-03-31
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| appsmith | appsmith | to 1.98 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34411 is a vulnerability in Appsmith versions prior to 1.98 where sensitive instance management API endpoints are exposed without requiring authentication.
Unauthenticated attackers can access endpoints such as /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve sensitive information including configuration metadata, license details, and unsalted SHA-256 hashes of admin email domains.
This exposure allows attackers to perform reconnaissance and plan targeted attacks against the affected Appsmith instances.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers with network access to gather sensitive information about your Appsmith instance without any credentials or user interaction.
- Attackers can obtain configuration metadata, license plan details, instance ID, enabled authentication providers, feature flags, session timeout settings, and enterprise features such as SAML SSO, SCIM provisioning, audit logs, branding, and granular access control.
- The unsalted SHA-256 hashes of admin email domains can be reversed to identify the organization operating the instance.
With this information, attackers can perform detailed reconnaissance and plan targeted attacks, potentially compromising the security of your organization.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the exposed management API endpoints without authentication on the Appsmith instance. Specifically, querying endpoints such as /api/v1/consolidated-api/view and /api/v1/tenants/current can reveal if sensitive configuration metadata is accessible without credentials.
A simple detection method is to use command-line tools like curl or wget to send HTTP GET requests to these endpoints and observe if sensitive information is returned.
- curl -v http://<appsmith-instance>/api/v1/consolidated-api/view
- curl -v http://<appsmith-instance>/api/v1/tenants/current
If these commands return configuration metadata, license information, or unsalted SHA-256 hashes of admin email domains without requiring authentication, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Appsmith to version 1.98 or later, where this vulnerability has been patched.
Until the upgrade can be performed, restrict network access to the Appsmith instance management API endpoints to trusted users only, for example by using firewall rules or network segmentation.
Additionally, monitor access logs for any unauthorized or suspicious requests to the affected API endpoints.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-34411 exposes sensitive configuration metadata and unsalted SHA-256 hashes of admin email domains without authentication, allowing unauthenticated attackers to gather detailed information about the affected Appsmith instance and its organization.
This unauthorized disclosure of sensitive information could potentially lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require protection of personal and organizational data against unauthorized access and disclosure.
Specifically, the exposure of license information, configuration metadata, and hashed email domains may violate confidentiality requirements and increase the risk of targeted attacks, thereby undermining compliance with standards that mandate safeguarding sensitive information.