Appsmith EUVD-2026-39111

Exploitation requires an authenticated Appsmith session with at least low-privilege access to create or modify REST API or GraphQL datasource plugin configurations - the vulnerable code path is only reachable through these two plugin types. The SMTP plugin path is not affected. The degree of real-world impact depends on what loopback-bound services are reachable inside the container at the time of exploitation; environments running additional internal services (metadata endpoints, internal APIs) on loopback are at elevated risk. Exploitation is limited by: (1) requirement for an authenticated Appsmith account with datasource-editing permissions, and (2) access is bounded to services reachable from within the container's loopback interface, not arbitrary external hosts.

The CVSS 4.0 base score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects the real-world constraint: exploitation requires a low-privilege authenticated session, which substantially limits the exposed attack surface compared to unauthenticated SSRF. The low complexity (AC:L, AT:N) means that once inside the application, crafting a bypassing request requires no special conditions or race timing. The confidentiality and integrity impact is rated low (VC:L/VI:L), consistent with the ability to probe and interact with internal loopback services rather than directly exfiltrate bulk data. Real-world risk scales significantly with deployment posture: in containerized environments where internal microservices, metadata endpoints (e.g., cloud provider IMDS at 169.254.169.254), or administrative APIs are co-located and unauthenticated, the practical impact exceeds what the CVSS score alone suggests. No KEV listing and no identified POC confirm this has not been widely exploited. EPSS data is not available in the provided intelligence. The absence of external scope change metrics (SC:N/SI:N) in the vendor-supplied CVSS 4.0 vector may understate cross-service reachability in multi-container deployments - this is a point of ambiguity that defenders in complex environments should verify independently.

An authenticated Appsmith user with datasource configuration permissions creates a new REST API datasource and sets the base URL to a loopback address variant not matched by the exact-match string denylist (e.g., an IPv6 representation of localhost or a non-standard encoding). The platform's WebClientUtils issues the outbound HTTP request without triggering the comprehensive address-class check, reaching an internal container service such as an unauthenticated admin API or metadata endpoint. No public proof-of-concept code has been identified at time of analysis.