CVE-2022-38299: Appsmith

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.

Affected products

• Appsmith Appsmith: version 1.7.11 only

Published 2022-09-12. Last modified 2026-06-17.