CVE-2026-5418
published 2026-04-02CVE-2026-5418: A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file…
PriorityP347high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.30%
21.9th percentile
A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected
98 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
| appsmithorg | appsmith | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-02
Published