ToolJet EUVD-2026-39469

Requires an authenticated ToolJet account (the advisory states any free-tier user suffices) with the ability to create or edit a RestAPI data source, and a target deployment whose server can reach a cloud metadata endpoint - concretely demonstrated against Azure IMDS at 169.254.169.254 in an AKS-hosted instance with an attached managed identity. The bypass specifically depends on the private-IP filter checking only the hostname string, so the attacker must supply a DNS name that encodes the metadata IP (e.g. 169.254.169.254.nip.io). Limiting factors: exploitation yields valuable results only where ToolJet runs in a cloud environment exposing IMDS with a privileged identity; non-cloud or egress-restricted deployments expose only generic internal SSRF, and account registration/authentication is needed despite the published vector's PR:N.

Signals are mixed but lean toward a genuine priority for ToolJet operators running in Azure/AKS. The CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) reflects easy network exploitation with scope change, but the published vector's PR:N conflicts with the description, which explicitly states 'any authenticated user (free tier)' is required - verify with the vendor; this is more realistically PR:L. The CVSS impact metrics (C:L/I:L/A:L) also appear conservative given that the documented outcome is theft of Azure managed-identity tokens for a production AKS cluster, which is a high-confidentiality, potentially environment-wide consequence. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation; risk is therefore driven by impact severity rather than confirmed exploitation pressure. The decisive factor is deployment context: ToolJet instances fronted by Azure IMDS with a privileged managed identity are high risk, whereas non-cloud or non-Azure deployments face only generic internal SSRF exposure.

An authenticated free-tier ToolJet user creates a RestAPI data source pointing at http://169.254.169.254.nip.io/metadata/identity/oauth2/token (with the IMDS-required header), which resolves to the Azure link-local metadata address and slips past the hostname-only private-IP filter. ToolJet's server issues the request and returns the managed-identity access token to the attacker, who then uses it to authenticate to Azure and pivot into the AKS production cluster. No public exploit code was provided, but the technique relies only on well-known public DNS encoding services and standard IMDS request formatting.