Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 27, 2026 · NIST NVD

   Detected

   Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.

2. Jul 14, 2026 · NIST NVD

   Updated

   Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.

Affected

• cpe appsmith/appsmithversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-34411

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-34411

  Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and uns

  nvd.nist.gov

References

• Exploit · github.com
• Third Party Advisory · vulncheck.com