Is there a public PoC exploit available for CVE-2026-5418?

Yes, a public proof-of-concept exploit is available for CVE-2026-5418. Prioritise patching immediately. EPSS: 0.0%.

Java CVE-2026-5418

Q: What is the CVSS score of CVE-2026-5418?

CVE-2026-5418 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18518 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-02 VulDB

Java SSRF Appsmith

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 19:01 euvd

EUVD-2026-18518

Analysis Generated

Apr 02, 2026 - 19:01 vuln.today

CVE Published

Apr 02, 2026 - 18:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Server-side request forgery (SSRF) in Appsmith Dashboard component allows unauthenticated remote attackers to manipulate the computeDisallowedHosts function in WebClientUtils.java, enabling unauthorized server-side requests. Affecting all versions through 1.97, this vulnerability carries moderate real-world risk (CVSS 6.9, EPSS P) with publicly available exploit code. Vendor released patched version 1.99 and responded professionally to early disclosure.

Technical ContextAI

The vulnerability resides in the WebClientUtils.java component within Appsmith's Dashboard functionality, specifically in the computeDisallowedHosts function responsible for validating and restricting outbound HTTP requests from the server. SSRF vulnerabilities (CWE-918) occur when insufficient validation of user-controlled input in URL parameters allows attackers to craft requests that bypass intended access controls, enabling the server to make requests to internal resources, local network services, or cloud metadata endpoints that should be unreachable. In Appsmith's case, the improper filtering of disallowed hosts allows an attacker to construct specially crafted payloads that circumvent the allowlist/blocklist mechanism, granting unauthorized access to backend services or internal systems the dashboard should not contact.

RemediationAI

Vendor-released patch: upgrade Appsmith to version 1.99 or later. Organizations should prioritize this upgrade immediately given the public exploit availability and low attack complexity. For environments unable to upgrade immediately, network segmentation and firewall rules restricting outbound connections from Appsmith instances to internal services can reduce attack surface, though such controls do not address the underlying vulnerability. Review GitHub Security Advisory GHSA-9m89-5jw7-q5cr at https://github.com/appsmithorg/appsmith/security/advisories/GHSA-9m89-5jw7-q5cr for comprehensive remediation guidance and to verify local instance versions.