What is the CVSS score of CVE-2026-55412?

CVE-2026-55412 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of ToolJet are affected by CVE-2026-55412?

ToolJet versions prior to 3.20.178-lts contain a server-side request forgery vulnerability in the RestAPI data source that allows attackers to obtain managed-identity tokens for Azure Kubernetes…. A patch is available.

How to fix or mitigate CVE-2026-55412?

24 hours: Identify all ToolJet instances and their current versions using deployment inventories; implement network-level restrictions blocking RestAPI data source outbound access to 169.254.169.254 and *.nip.io domains. 7 days: Review all RestAPI data source configurations for suspicious DNS usage patterns; audit and rotate Azure managed-identity tokens assigned to affected AKS clusters; implement network policies to deny egress to metadata service endpoints. 30 days: Upgrade all ToolJet instances to version 3.20.178-lts or later; validate the upgrade in staging environment before production rollout; verify network segmentation policy enforcement post-upgrade.

ToolJet CVE-2026-55412

EUVD-2026-39469 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-25 GitHub_M

SSRF Microsoft Tooljet

8.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

8.5 HIGH

Network-reachable and low-complexity, but requires an authenticated account (PR:L); scope changes as the SSRF pivots to Azure IMDS, and stolen cloud tokens make confidentiality High.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 25, 2026 - 18:03 EUVD

Analysis Generated

Jun 25, 2026 - 17:18 vuln.today

CVE Published

Jun 25, 2026 - 16:07 cve.org

HIGH 8.3

DescriptionCVE.org

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string - not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the Azure IMDS link-local address and bypass the filter entirely. This allows any authenticated user (free tier) to steal Azure managed identity tokens for the AKS production cluster. This vulnerability is fixed in 3.20.178-lts.

AnalysisAI

Server-side request forgery in ToolJet's RestAPI data source (versions prior to 3.20.178-lts) allows a low-privileged platform user to reach internal network endpoints because the private-IP filter validates only the hostname string rather than the resolved IP. By supplying a DNS name such as 169.254.169.254.nip.io, an attacker bypasses the filter and forces the server to query the Azure IMDS link-local endpoint, enabling theft of managed-identity tokens for the backing AKS production cluster. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the cloud-credential impact makes it a high-value SSRF.

Technical ContextAI

The vulnerability lives in ToolJet's RestAPI data source connector, which performs HTTP requests server-side on behalf of the user. As a SSRF (CWE-918), the root cause is an allow/deny decision made on attacker-controlled input before the request is dispatched. The flawed control is an anti-SSRF guard that blocklists private/link-local IP ranges by inspecting the literal hostname string, not the address the hostname ultimately resolves to. Public DNS rebinding-style services like nip.io (and xip.io) encode an arbitrary IPv4 address inside a public-looking hostname (e.g. 169.254.169.254.nip.io → 169.254.169.254), so the string check passes while the socket connects to the cloud metadata service. In Azure/AKS deployments, IMDS at 169.254.169.254 exposes managed-identity OAuth tokens to any process that can issue HTTP requests from the node, turning an internal-tooling SSRF into a cloud identity compromise.

RemediationAI

Upgrade to ToolJet 3.20.178-lts, which contains the fix, per advisory GHSA-h49f-mhmm-jx4w (https://github.com/ToolJet/ToolJet/security/advisories/GHSA-h49f-mhmm-jx4w). Until patched, reduce blast radius by hardening the cloud identity layer rather than relying on the broken hostname filter: enforce IMDSv2-style protections and, where possible, block egress from the ToolJet pods/nodes to the link-local 169.254.169.254 address (for example via Kubernetes NetworkPolicy or node iptables), accepting that legitimate workloads needing IMDS will also lose access. Scope the AKS managed identity to least privilege so a stolen token grants minimal capability, and consider disabling or restricting the RestAPI data source for untrusted/free-tier users, which trades off self-service flexibility for safety. Because nip.io-style bypasses defeat naive hostname blocklists, any temporary application-layer filter should resolve the target and re-check the resulting IP, not just the string.