Vulnerabilidades do ToolJet ToolJet

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam ToolJet ToolJet: 3 registro(s), com versões afetadas e correções.

CVE-2026-55413 Crítica · 9.4 CWE-94 25/06/2026

ToolJet: injeção de código no servidor via plugin compartilhado do marketplace

ToolJet é a fundação de código aberto de uma plataforma nativa de IA para construir e implantar ferramentas internas, fluxos de trabalho e agentes de IA. Antes da versão 3.20.178-lts, qualquer usuário autenticado com a função builder (nível gratuito) pode sobrescrever um plugin do marketplace compartilhado globalmente com JavaScript arbitrário que é executado no lado do servidor com acesso total ao Node.js (require, process). O código malicioso é executado sempre que qualquer usuário da instância dispara uma consulta usando esse plugin — alcançando tanto RCE quanto comprometimento de cadeia de suprimentos de toda a implantação do ToolJet. Esta vulnerabilidade está corrigida na versão 3.20.178-lts.

CVE-2026-55412 Alta · 8.3 CWE-918 25/06/2026

ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string — not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the Azure IMDS link-local address and bypass the filter entirely. This allows any authenticated user (free tier) to steal Azure managed identity tokens for the AKS production cluster. This vulnerability is fixed in 3.20.178-lts.

CVE-2026-55411 Média · 6.8 CWE-639 25/06/2026

ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credential_id is supplied in the request body. Unlike every neighbouring data-source route, this handler is not protected by ValidateDataSourceGuard, does not receive the calling @User(), and the underlying CredentialsService.getValue() looks the credential up by id only, with no organization scoping. As a result, any authenticated user of any organization can decrypt the data-source secrets of any other organization by supplying that organization's credential_id — a cross-tenant confidentiality breach. This vulnerability is fixed in 3.20.1780-lts.