Is CVE-2026-55411 actively exploited?

No active exploitation of CVE-2026-55411 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-55411 be exploited remotely?

Partially. CVE-2026-55411 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-55411?

CVE-2026-55411 has a CVSS score of 6.8 (MEDIUM).

HOME VULNERABILITIESCVE-2026-55411

MEDIUM

CVE-2026-55411

CWE-639Published: June 25, 2026· Updated: Jun 25, 2026

6.8

CVSS v3.1

EPSS:0.13%probability of exploitation in 30 daysPercentile:2.6th

Official Description

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credential_id is supplied in the request body. Unlike every neighbouring data-source route, this handler is not protected by ValidateDataSourceGuard, does not receive the calling @User(), and the underlying CredentialsService.getValue() looks the credential up by id only, with no organization scoping. As a result, any authenticated user of any organization can decrypt the data-source secrets of any other organization by supplying that organization's credential_id — a cross-tenant confidentiality breach. This vulnerability is fixed in 3.20.1780-lts.

NVD Source

Technical Analysis

CVE-2026-55411 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.8.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.