CVE-2026-55412 Details
Description
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string — not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the Azure IMDS link-local address and bypass the filter entirely. This allows any authenticated user (free tier) to steal Azure managed identity tokens for the AKS production cluster. This vulnerability is fixed in 3.20.178-lts.
A server-side request forgery (SSRF) vulnerability has been identified in ToolJet Cloud versions prior to 3.20.178-lts. The issue resides in the RestAPI data source component, which executes HTTP requests from the server side. The component's private IP filter only examines the hostname string and not the resolved IP address. This flaw allows DNS names like '169.254.169.254.nip.io' to bypass the filter and access the Azure Instance Metadata Service (IMDS) link-local address. As a result, any authenticated user on the free tier can steal Azure managed identity tokens for the Azure Kubernetes Service (AKS) production cluster.
Users are advised to update to ToolJet version 3.20.178-lts or later. Additionally, the private IP filter should be improved to resolve DNS before checking, block certain localhost addresses, and validate the resolved IP. Enabling SSRF protection by default is also recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ToolJet/ToolJet/security/advisories/GHSA-h49f-mhmm-jx4w | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ToolJet/ToolJet/security/advisories/GHSA-h49f-mhmm-jx4w | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ToolJet | < 3.20.178-lts (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |