CVE-2026-34411

Executive Summary

CVE-2026-34411 exposes a critical authentication bypass vulnerability in Appsmith versions prior to 1.98. Unauthenticated attackers can query sensitive instance management API endpoints, including /api/v1/consolidated-api/view and /api/v1/tenants/current, to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains. This flaw enables reconnaissance and targeted attack planning without any prior authentication.

Supply Chain & Package Security

Appsmith is a self-hosted, open-source low-code platform typically deployed via Docker, Kubernetes, or direct Node.js installation. The vulnerability affects the core backend service, which is distributed as a Docker image (appsmith/appsmith-server) and as an npm package (appsmith). Organizations using these distribution methods must verify their deployed version and apply the patch immediately. The exposure of unsalted SHA-256 hashes of admin email domains increases the risk of credential stuffing and targeted phishing attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the ease of exploitation and the sensitive nature of the exposed data. While integrity and availability are not directly impacted, the leaked configuration metadata and admin email hashes can facilitate further attacks.

Deep Dive & Mechanics

The vulnerability stems from missing authentication checks on several instance management API endpoints. In Appsmith versions prior to 1.98, the following endpoints are accessible without any authentication:

• /api/v1/consolidated-api/view – Returns consolidated configuration metadata, including database connection strings, feature flags, and internal service URLs.
• /api/v1/tenants/current – Returns tenant-specific information, including license details, instance ID, and unsalted SHA-256 hashes of admin email domains.

The lack of authentication middleware on these routes allows any unauthenticated HTTP request to retrieve sensitive data. The unsalted SHA-256 hashes of admin email domains are particularly dangerous because they can be reversed using rainbow tables or brute-force attacks, enabling attackers to identify valid admin email domains for targeted phishing or credential stuffing.

The vulnerability is present in the backend API layer, which is typically implemented in Java (Spring Boot) for Appsmith. The affected code paths do not enforce any session or token validation before processing these requests.

Vulnerable vs. Patched Code

Vulnerable Code (Appsmith < 1.98):

@RestController
@RequestMapping("/api/v1")
public class ConsolidatedApiController {

    @GetMapping("/consolidated-api/view")
    public ResponseEntity<ConsolidatedView> getConsolidatedView() {
        // No authentication check
        ConsolidatedView view = consolidatedService.getView();
        return ResponseEntity.ok(view);
    }

    @GetMapping("/tenants/current")
    public ResponseEntity<Tenant> getCurrentTenant() {
        // No authentication check
        Tenant tenant = tenantService.getCurrentTenant();
        return ResponseEntity.ok(tenant);
    }
}

Patched Code (Appsmith >= 1.98):

@RestController
@RequestMapping("/api/v1")
public class ConsolidatedApiController {

    @GetMapping("/consolidated-api/view")
    @PreAuthorize("isAuthenticated()")
    public ResponseEntity<ConsolidatedView> getConsolidatedView() {
        ConsolidatedView view = consolidatedService.getView();
        return ResponseEntity.ok(view);
    }

    @GetMapping("/tenants/current")
    @PreAuthorize("isAuthenticated()")
    public ResponseEntity<Tenant> getCurrentTenant() {
        Tenant tenant = tenantService.getCurrentTenant();
        return ResponseEntity.ok(tenant);
    }
}

The patch adds @PreAuthorize("isAuthenticated()") annotations to the vulnerable endpoints, ensuring that only authenticated users can access them. This is a standard Spring Security mechanism that checks for a valid session or token before processing the request.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Appsmith instance (version < 1.98) running on a target network.
• Network access to the Appsmith API endpoint (typically port 80 or 443).

Exploitation Steps:

1. Reconnaissance: Use Shodan or manual scanning to identify Appsmith instances. Look for HTTP responses containing "Appsmith" in the title or API paths.

2. Query the Consolidated API:

   curl -X GET http://target:8080/api/v1/consolidated-api/view
   

   This returns a JSON payload containing configuration metadata, including database connection strings, feature flags, and internal service URLs.

3. Query the Tenant API:

   curl -X GET http://target:8080/api/v1/tenants/current
   

   This returns tenant-specific information, including license details, instance ID, and unsalted SHA-256 hashes of admin email domains.

4. Crack Admin Email Hashes: Extract the adminEmailDomainHash field from the tenant response. Use a tool like hashcat or john to crack the unsalted SHA-256 hash:

   echo "hash_here" > hash.txt
   hashcat -m 1400 hash.txt /usr/share/wordlists/rockyou.txt
   

5. Plan Targeted Attacks: Use the cracked admin email domains to craft phishing emails or perform credential stuffing against the Appsmith login page.

Lab Setup:

• Deploy a vulnerable Appsmith instance using Docker:

  docker run -d -p 8080:80 appsmith/appsmith-server:1.97
  

• Verify the vulnerability by accessing the endpoints without authentication.

Blue Team

Detection:

• Monitor for unauthorized access to /api/v1/consolidated-api/view and /api/v1/tenants/current endpoints.
• Look for HTTP 200 responses to these endpoints from IP addresses not associated with authenticated users.
• Alert on repeated attempts to access these endpoints from the same source IP.

Hunting:

• Search web server logs for requests to the vulnerable endpoints without a valid session cookie or Authorization header.
• Correlate with failed login attempts to identify potential credential stuffing attacks.

Response:

• Immediately upgrade to Appsmith version 1.98 or later.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block access to the vulnerable endpoints from untrusted IPs.
• Rotate any secrets or credentials that may have been exposed in the configuration metadata.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /api/v1/consolidated-api/view
  • HTTP GET requests to /api/v1/tenants/current
  • Source IPs performing reconnaissance on these endpoints

• File IOCs:

  • Log entries containing the strings /api/v1/consolidated-api/view or /api/v1/tenants/current from unauthenticated sources

• Behavioral IOCs:

  • Unusual number of requests to the Appsmith API from a single IP address
  • Requests to these endpoints without a valid session cookie or Authorization header

Detection Engineering

YARA Rule

rule CVE_2026_34411_Appsmith_Unauthenticated_API_Access {
    meta:
        description = "Detects unauthenticated access to Appsmith instance management API endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-34411"
        severity = "high"
    strings:
        $endpoint1 = "/api/v1/consolidated-api/view"
        $endpoint2 = "/api/v1/tenants/current"
        $unauth = "HTTP/1.1 200 OK"
    condition:
        any of ($endpoint*) and $unauth
}

Sigma Rule

title: Unauthenticated Access to Appsmith Instance Management API
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated HTTP requests to Appsmith instance management API endpoints
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34411
logsource:
    category: webserver
    product: appsmith
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/api/v1/consolidated-api/view'
            - '/api/v1/tenants/current'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users accessing these endpoints
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34411 - Appsmith Unauthenticated API Access"; flow:to_server,established; content:"GET"; http_method; content:"/api/v1/consolidated-api/view"; http_uri; nocase; content:"/api/v1/tenants/current"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Appsmith: Update to version 1.98 or later. For Docker deployments:

   docker pull appsmith/appsmith-server:1.98
   docker-compose up -d
   

2. Restrict Network Access: If immediate patching is not possible, restrict access to the Appsmith API endpoints using a firewall or WAF. Block external access to /api/v1/consolidated-api/view and /api/v1/tenants/current.
3. Rotate Secrets: If configuration metadata or admin email hashes were exposed, rotate all secrets, API keys, and database credentials. Force password resets for admin accounts.

Long-Term Measures:

1. Implement Authentication Middleware: Ensure all API endpoints enforce authentication using Spring Security or equivalent.
2. Use Salted Hashes: Replace unsalted SHA-256 hashes with salted bcrypt or Argon2 for storing admin email domains.
3. Regular Security Audits: Conduct periodic code reviews and penetration testing to identify similar authentication bypass vulnerabilities.
4. Monitor for Exploitation: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT

{/* [Security Hash: D0954E69EA0F90FC323C99F9] */}