CVE-2026-94829
/api/v1/admin/env discloses MongoDB root credentials in cleartext
| CVE | CVE-2026-94829 |
|---|---|
| Status | RESERVED |
| Product | Appsmith Community Edition |
| Affected | <= v1.99 for the unauthenticated path |
| Fixed | v2.0 closed the pre-auth route to super-admin |
| CWE | CWE-200 |
| CVSS 3.1 | 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/APPSMITH.md |
Detail
GET /api/v1/admin/env returns the instance environment unmasked, including mongodb://appsmith:<password>@… with embedded credentials and the Redis URL. The MongoDB user holds role: root, confirmed via db.runCommand({connectionStatus:1}).authInfo.authenticatedUserRoles.
Super-admin gated, which is why it scores 4.9 standalone — it is the last link of the chain, reached for free via CVE-2026-94831.
Remediation
See chains/APPSMITH.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/APPSMITH.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94829.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch