Is CVE-2026-55412 actively exploited?

No active exploitation of CVE-2026-55412 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-55412 be exploited remotely?

Yes. CVE-2026-55412 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-55412?

CVE-2026-55412 has a CVSS score of 8.3 (HIGH).

HOME VULNERABILITIESCVE-2026-55412

HIGH

CVE-2026-55412

CWE-918Published: June 25, 2026· Updated: Jun 25, 2026

8.3

CVSS v3.1

EPSS:0.19%probability of exploitation in 30 daysPercentile:9.1th

Official Description

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string — not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the Azure IMDS link-local address and bypass the filter entirely. This allows any authenticated user (free tier) to steal Azure managed identity tokens for the AKS production cluster. This vulnerability is fixed in 3.20.178-lts.

NVD Source

Technical Analysis

CVE-2026-55412 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.