CVE-2026-49979: Appsmith Information Disclosure Flaw

CVE-2026-49979 Overview

CVE-2026-49979 affects Appsmith, an open-source platform used to build admin panels, internal tools, and dashboards. The vulnerability resides in the POST /api/v1/admin/send-test-email endpoint in versions prior to 1.99. The endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without IP validation. This bypasses the WebClientUtils.IP_CHECK_FILTER protection, which only applies to Spring WebClient HTTP requests. The endpoint also returns raw MailException.getMessage() output verbatim in API responses, enabling error-based reconnaissance against internal infrastructure.

Critical Impact
Authenticated administrators can leverage the test-email endpoint to perform internal port scanning and service banner enumeration against hosts otherwise unreachable from the internet.

Affected Products

Appsmith versions prior to 1.99
Self-hosted Appsmith deployments exposing the admin API
Appsmith instances where administrator credentials are reachable by untrusted users

Discovery Timeline

2026-06-24 - CVE-2026-49979 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-49979

Vulnerability Analysis

The flaw is a Server-Side Request Forgery (SSRF) combined with information disclosure through error messages [CWE-209]. The send-test-email administrative endpoint was designed to validate outbound SMTP configuration. Instead of restricting destinations, it forwards user-supplied smtpHost and smtpPort parameters directly to JavaMail, which opens a raw TCP socket to the target.

Because the connection is established at the transport layer, it never traverses Spring's WebClient pipeline. The existing IP_CHECK_FILTER, which blocks loopback, link-local, and private address ranges for HTTP-based clients, is therefore not consulted. Attackers can target 127.0.0.1, RFC1918 ranges, cloud metadata endpoints, and adjacent internal services.

The second half of the issue amplifies the impact. When the SMTP handshake fails, the backend returns MailException.getMessage() verbatim. That message frequently contains the remote service banner or protocol error string. An attacker iterates through ports and reads the response to map internal services.

Root Cause

The root cause is missing destination validation on a transport-layer connection combined with verbose error propagation to the API client. The host and port are trusted inputs, and exception output is not sanitized before being serialized into the HTTP response.

Attack Vector

Exploitation requires high privileges, since the endpoint sits under /api/v1/admin/. An authenticated administrator issues a POST request supplying an internal IP and a probed port in the smtpHost and smtpPort fields. The response body discloses whether the port is open, closed, or filtered, and frequently echoes a partial banner from the targeted service. Repeated requests build a map of the internal network reachable from the Appsmith server.

No verified public exploit code is available. See the GitHub Security Advisory for additional technical context.

Detection Methods for CVE-2026-49979

Indicators of Compromise

Repeated POST requests to /api/v1/admin/send-test-email from a single administrator session within a short interval
Requests where smtpHost resolves to loopback, RFC1918, link-local, or cloud metadata addresses such as 169.254.169.254
API responses containing non-SMTP banner strings such as SSH-2.0, HTTP/1.1, or Redis -ERR text inside MailException messages
Outbound TCP connections from the Appsmith JVM to non-standard SMTP ports (22, 80, 6379, 3306, 8080)

Detection Strategies

Alert on administrator endpoints invoked more than a threshold number of times per minute per session
Parse Appsmith application logs for MailException traces containing internal IP literals or non-SMTP protocol tokens
Correlate web access logs for the send-test-email path with network flow data showing connections to internal subnets
Hunt for anomalous egress from the Appsmith container or host targeting RFC1918 ranges

Monitoring Recommendations

Forward Appsmith API access logs and JVM exception logs to a centralized analytics platform for retention and search
Enable network-layer egress monitoring on the host running Appsmith and baseline expected SMTP destinations
Track changes to the Appsmith version string and alert when instances older than 1.99 remain in production

How to Mitigate CVE-2026-49979

Immediate Actions Required

Upgrade Appsmith to version 1.99 or later, which contains the official fix
Audit administrator accounts and rotate credentials for any account with access to the admin API
Review historical access logs for /api/v1/admin/send-test-email usage and investigate any responses containing internal addresses
Restrict network egress from the Appsmith server so only legitimate SMTP relays are reachable

Patch Information

The vulnerability is fixed in Appsmith 1.99. The upstream patch and full advisory are published in the GitHub Security Advisory GHSA-vvxf-f8q9-86gh. Operators of self-hosted deployments should plan an immediate upgrade.

Workarounds

Place the Appsmith admin API behind a reverse proxy that blocks the send-test-email route until the patch is applied
Enforce egress firewall rules on the Appsmith host that permit outbound traffic only to approved SMTP servers and ports
Limit administrator role assignment to a minimal set of trusted operators and require multi-factor authentication for those accounts

bash

# Example egress allowlist using iptables, restricting SMTP to a known relay
iptables -A OUTPUT -p tcp -d 10.20.30.40 --dport 587 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25  -j REJECT
iptables -A OUTPUT -p tcp --dport 465 -j REJECT
iptables -A OUTPUT -p tcp --dport 587 -j REJECT