CVE-2026-34411: Appsmith

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.

Affected products

• Appsmith Appsmith: before 1.98 (fixed in 1.98)

Published 2026-03-27. Last modified 2026-07-14.