CVE-2026-94831
Unauthenticated embedded Redis permits Spring session theft and super-admin takeover
| CVE | CVE-2026-94831 |
|---|---|
| Status | RESERVED (GHSA-qhfj-g87x-m39w) |
| Product | Appsmith Community Edition |
| Affected | <= v1.99 |
| Fixed | v2.0 (requirepass, commit 0d99237a1); explicitly v2.2 (commit 48ac053d5e) |
| CWE | CWE-287, CWE-384 |
| CVSS 3.1 | 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/APPSMITH.md |
Detail
The bundled Redis listens on 127.0.0.1:6379 with requirepass empty. Spring Session stores every live session there under spring:session:sessions:<UUID> with a 30-day TTL, each containing the full user identity in cleartext JSON.
Any self-registered user — open signup is on by default — creates a Redis datasource to loopback, runs KEYS and HGETALL, reads a super-admin's session UUID, and sets it as their own SESSION cookie. No credential is cracked and no token is forged.
Vendor acknowledgement: commit 48ac053d5e is titled "fix(security): block Redis datasource from internal Appsmith Redis (GHSA-qhfj-g87x-m39w)" — it names this advisory.
Remediation
See chains/APPSMITH.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/APPSMITH.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94831.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch