CVE-2026-55412

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string — not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the Azure IMDS link-local address and bypass the filter entirely. This allows any authenticated user (free tier) to steal Azure managed identity tokens for the AKS production cluster. This vulnerability is fixed in 3.20.178-lts.

• CWE-918

• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-h49f-mhmm-jx4w
• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-h49f-mhmm-jx4w

Published

Jun 25, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55407Buffa is a pure-Rust Protocol Buffers implementation with fi…6.3
• CVE-2026-55408Koodo Reader is an ebook reader. In version 2.3.0 and earlie…8.4
• CVE-2026-55409Filament is a collection of full-stack components for accele…7.6
• CVE-2026-5541A vulnerability was found in code-projects Simple Laundry Sy…4.3
• CVE-2026-55410NocoBase is an AI-powered no-code/low-code platform for buil…6.7
• CVE-2026-55411ToolJet is the open-source foundation am AI-native platform …6.8
• CVE-2026-55413ToolJet is the open-source foundation am AI-native platform …9.4
• CVE-2026-55415datamodel-code-generator generates Pydantic v2 models, datac…7.5
• CVE-2026-55417Chevereto is a self-hosted media-sharing platform. Starting …6.9
• CVE-2026-55418FastGPT is an open source AI knowledge base platform. Prior …8.6
• CVE-2026-5542A vulnerability was determined in code-projects Simple Laund…4.3
• CVE-2026-55420Discourse is an open-source discussion platform. Prior to 20…8.1