CVE-2026-55412: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI…

Summary

ToolJet, an open-source platform for building internal tools and AI agents, has an SSRF flaw in its RestAPI data source component before 3.20.178-lts. The private IP filter checks only the hostname string, not the resolved IP, so a DNS name such as 169.254.169.254.nip.io reaches the Azure IMDS link-local address. Any authenticated user, including free-tier accounts, can steal Azure managed identity tokens for the AKS production cluster.

Mitigation

Fixed in 3.20.178-lts.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News