CVE-2026-55455 Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils used by the REST API and GraphQL datasource plugins validates hosts against an exact-match string denylist. The comprehensive address-class check...

CVE-2026-55455

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils used by the REST API and GraphQL datasource plugins validates hosts against an exact-match string denylist. The comprehensive address-class check...

CVE-2026-55455: Server-Side Request Forgery (SSRF)

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils used by the REST API and GraphQL datasource plugins validates hosts against an exact-match string denylist. The comprehensive address-class check...

strawberry-graphql (>=0.13.0, <=0.13.1) potentially affected by CVE-2026-54282 via starlette (0.12.1)

starlette PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - strawberry-graphql =0.13.0, =0.13.1 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-54282 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

aiida-graphql (>=0.0.1, <=0.0.2), postblog (>=0.4.1, <=0.5.2) +1 more potentially affected by CVE-2026-54282 via starlette (0.12.10)

starlette PYPI version 0.12.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aiida-graphql =0.0.1, =0.4.1, =0.16.5, =0.18.1 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

bocadillo (>=0.12.3, <=0.14.2), starlette-jsonrpc (>=0.1.0, <=0.2.0) +2 more potentially affected by CVE-2026-54282 via starlette (0.11.4)

starlette PYPI version 0.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bocadillo =0.12.3, =0.1.0, =0.1.0, =0.11.0 - termpair 0.0.0.2 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

aioboot (0.3.0), dms (0.0.3) +3 more potentially affected by CVE-2026-54282 via starlette (0.13.0)

starlette PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aioboot 0.3.0 - dms 0.0.3 - piccolo-admin =0.3.1, =0.4.2, =0.18.2, =0.21.1 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

strawberry-graphql (>=0.13.2, <=0.13.4) potentially affected by CVE-2026-54282 via starlette (0.12.4)

starlette PYPI version 0.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - strawberry-graphql =0.13.2, =0.13.4 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-54282 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

piccolo-admin (0.6.0), piccolo-api (0.7.0) +2 more potentially affected by CVE-2026-54282 via starlette (0.13.3)

starlette PYPI version 0.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - piccolo-admin 0.6.0 - piccolo-api 0.7.0 - starlette-graphql-zifulu =0.0.1a3, =0.22.0, =0.24.1 Source cves: CVE-2026-54282 Source advisory:...

GHSA-4MVW-J8R9-XCGC OpenCTI May Bypass Introspection Restriction

Summary The regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. Details GraphQL Queries in OpenCTI can be validated using the secureIntrospectionPlugin. Impact Bypassing this restriction...

OpenCTI May Bypass Introspection Restriction

Summary The regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. Details GraphQL Queries in OpenCTI can be validated using the secureIntrospectionPlugin. Impact Bypassing this restriction...

EUVD-2024-36468

OpenCTI May Bypass Introspection Restriction...

CVE-2026-8934

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934

The CVE-2026-8934 describes a Missing Authorization vulnerability in a GraphQL private API operation within Google App Engine Cloud Console, enabling an unauthenticated attacker to leak sensitive App Engine request logs from other projects via a crafted request. Affected component: Google Cloud C...

CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

EUVD-2026-38262

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...