Is CVE-2026-34411 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34411 being exploited in the wild.

How severe is CVE-2026-34411?

Medium severity, with a CVSS score of 5.3, published 27 March 2026.

Is there a fix for CVE-2026-34411?

A patch was published on 2026-03-27: Fix confirmed available in version 1.98 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34411 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34411?

Check whether you run Appsmith at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34411: Appsmith missing authentication in instance management API endpoints

CVE-2026-34411 · Severity: medium · CVSS 5.3 · Published 2026-03-27

Appsmith, a platform used to build internal business tools, contains a security flaw where sensitive system information is accessible to anyone on the network without a password. An attacker can view details about the organization's license, active security features like Single Sign-On (SSO), and internal configuration settings. This information acts as a blueprint for more advanced targeted attacks or data breaches by revealing exactly how the system is protected and who manages it.

Technologies: Appsmith. Vendors: Appsmith.

Quick answers

Is CVE-2026-34411 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34411 being exploited in the wild.
How severe is CVE-2026-34411?: Medium severity, with a CVSS score of 5.3, published 27 March 2026.
Which products and versions are affected?: Appsmith < 1.98.
Is there a fix for CVE-2026-34411?: A patch was published on 2026-03-27: Fix confirmed available in version 1.98 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34411 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34411?: Check whether you run Appsmith at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Appsmith versions prior to 1.98 suffer from a missing authentication vulnerability (CWE-306) in several management API endpoints, including /api/v1/consolidated-api/view, /api/v1/users/features, and /api/v1/tenants/current. These endpoints, intended for internal application performance monitoring, are accessible to unauthenticated network attackers. Exploitation allows the retrieval of sensitive metadata such as license plans, instance IDs, session timeouts, and unsalted SHA-256 hashes of administrator email domains. The admin domain hashes are particularly vulnerable to brute-force attacks using commodity hardware, enabling attackers to identify the specific organization operating the instance and plan further targeted exploits based on the revealed security posture (e.g., SAML, OIDC, or SCIM status). The issue is resolved in version 1.98.

Affected products

Appsmith Appsmith < 1.98

Timeline

2026-03-26: advisory: GitHub Security Advisory published by Appsmith team
2026-03-27: disclosed: CVE-2026-34411 published to NVD
2026-03-27: patched: Fix confirmed available in version 1.98

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.