CVE-2026-55411: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI

ToolJet, an open-source platform for building internal tools and AI agents, had a security flaw in versions before 3.20.1780-lts where an authenticated endpoint (POST /api/data-sources/decrypt) could decrypt sensitive database credentials for any organization if you knew the credential ID, even if you weren't part of that organization. This is a cross-tenant confidentiality breach (unauthorized access to another organization's secrets) because the endpoint lacked proper security checks that other similar endpoints had.