Which versions of Appsmith are affected by CVE-2026-34411?

CVE-2026-34411 presents notable security risk, a missing authentication vulnerability rated CVSS 6.9. This could allow unauthorized access to protected resources.. A patch is available.

How to fix or mitigate CVE-2026-34411?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Appsmith CVE-2026-34411

Q: What is the CVSS score of CVE-2026-34411?

CVE-2026-34411 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-16721 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-03-27 VulnCheck

GHSA-hvm5-gpg2-9x56

Authentication Bypass Appsmith

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 16:45 euvd

EUVD-2026-16721

Analysis Generated

Mar 27, 2026 - 16:45 vuln.today

Patch released

Mar 27, 2026 - 16:45 nvd

Patch available

CVE Published

Mar 27, 2026 - 16:24 nvd

MEDIUM 6.9

DescriptionCVE.org

Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.

AnalysisAI

Appsmith versions prior to 1.98 allow unauthenticated remote attackers to access sensitive instance management API endpoints (/api/v1/consolidated-api/view, /api/v1/tenants/current) without authentication, enabling disclosure of configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains. This authentication bypass facilitates reconnaissance for targeted follow-up attacks against Appsmith deployments and their administrators. No public exploit code or active exploitation has been independently confirmed at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-306 (Missing Authentication Check), a root cause where critical API endpoints fail to enforce authentication mechanisms before exposing sensitive instance data. Appsmith (cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*) is an open-source low-code application platform that manages APIs, databases, and configurations through RESTful endpoints. The affected endpoints (/api/v1/consolidated-api/view and /api/v1/tenants/current) are part of the consolidated API and tenant management layers, which should be protected by authentication checks before returning metadata, licensing details, and credential-related information such as email domain hashes. The exposure of unsalted SHA-256 hashes further weakens security posture, as these hashes are subject to efficient precomputation and rainbow table attacks without modern salting practices.

RemediationAI

Upgrade Appsmith to version 1.98 or later to apply the vendor-released patch. This is the primary and only confirmed mitigation. Until patching is possible, implement network-level access controls by restricting access to Appsmith instance API endpoints (particularly /api/v1/consolidated-api/view and /api/v1/tenants/current) to trusted internal networks only, and deploy a reverse proxy or WAF with authentication enforcement in front of these endpoints. Monitor for suspicious access patterns to sensitive endpoints from external or unauthenticated sources. Review logs for any instances where sensitive metadata, license information, or email domain hashes may have been accessed prior to patching.