CVE-2026-94830
Database datasource plugins bypass the WebClientUtils SSRF filter entirely
| CVE | CVE-2026-94830 |
|---|---|
| Status | RESERVED |
| Product | Appsmith Community Edition |
| Affected | <= v2.2 |
| Fixed | v2.3 (commit 800cf99804, PR #41985) |
| CWE | CWE-918 |
| CVSS 3.1 | 6.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/APPSMITH.md |
Detail
SSRF protection lives in WebClientUtils.java and applies only to Spring WebClient HTTP requests. Redis (Jedis), PostgreSQL/MySQL/MSSQL (JDBC) and MongoDB (Java driver) all open raw TCP and never touch it. At v1.98 none of their validateDatasource() methods performed host validation at all, yielding a three-state port oracle: 127.0.0.1:6379 221 ms "Unable to validate object", :27017 20 s timeout, :59999 52 ms "Failed connecting".
v2.3 applies RestrictedHostFilter on the datasource connection path. PR #41985 states that the filter intentionally still permits RFC 1918, so customers' private-network datasources keep working. This record covers the complete absence of host policy on that path before v2.3, not the residual permitted range.
Remediation
See chains/APPSMITH.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/APPSMITH.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94830.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch