CVE-2026-55412: ToolJet SSRF in RestAPI Data Source Leaks Azure IMDS Tokens

Technical summary

The RestAPI data source in ToolJet performs server-side HTTP requests and implements a private IP filter intended to prevent SSRF attacks. However, the filter validates only the hostname string rather than the resolved IP address. This allows attackers to use DNS rebinding techniques—specifically, DNS names like 169.254.169.254.nip.io that resolve to link-local addresses—to reach the Azure IMDS endpoint at 169.254.169.254:80. The IMDS service exposes managed identity tokens without authentication when queried from within the same cloud environment. An authenticated user (including free-tier accounts) can craft a malicious RestAPI request that bypasses the hostname filter and retrieves Azure managed identity credentials for the host AKS cluster, compromising cluster authentication.

Business impact

If exploited, this vulnerability enables lateral movement and privilege escalation within cloud-hosted deployments. An attacker with a free ToolJet account gains access to production Kubernetes credentials, allowing them to assume roles with cluster-wide permissions. This can lead to unauthorized access to sensitive workloads, data exfiltration, cluster compromise, and potential disruption of business-critical services running on AKS. The blast radius is particularly severe for organizations running ToolJet in Azure environments without additional network controls.

Affected systems

ToolJet versions prior to 3.20.178-lts are affected. The vulnerability requires the RestAPI data source component to be available and the deployment to be hosted in Azure. Organizations running ToolJet on-premises, in non-Azure cloud providers, or in isolated networks with outbound IMDS filtering are at lower risk, though the fundamental design flaw affects all versions before the patch. Deployments in AWS (with EC2 metadata service protection) or GCP may have different exposure profiles depending on metadata service configuration.

Exploitability

Exploitability is moderate to high. The attack requires only a user account on the ToolJet instance (including free tier), no special network position, and no victim interaction. The attacker must know or discover that ToolJet is running in Azure and that the RestAPI data source is enabled. The exploitation technique—using DNS rebinding via services like nip.io—is well-known in the SSRF community and requires minimal technical sophistication. However, the attacker must have valid credentials or access to create an account on the target ToolJet instance.

Remediation

Immediately upgrade to ToolJet version 3.20.178-lts or later. This release patches the RestAPI filter to validate resolved IP addresses rather than relying solely on hostname strings. Organizations unable to patch immediately should disable the RestAPI data source component or implement network-level controls to block outbound requests to link-local addresses (169.254.0.0/16). For Azure deployments, consider using Azure Policy to restrict metadata service access or employ additional authentication mechanisms for managed identities.

Patch guidance

Verify the installed ToolJet version against the vendor release notes for 3.20.178-lts. The patch modifies the IP validation logic in the RestAPI data source component to resolve the hostname and check the resulting IP address against the private IP blocklist. Test the patch in a staging environment before production deployment to ensure RestAPI integrations with legitimate internal services continue to function. Review any existing RestAPI data source configurations that may have been created as workarounds and consolidate them post-patch.

Detection guidance

Monitor ToolJet logs for RestAPI requests targeting link-local addresses or the Azure IMDS endpoint (169.254.169.254). Look for requests using DNS names with patterns common in rebinding attacks (e.g., nip.io, xip.io, or similar services). Check for authentication token retrieval patterns in HTTP request logs, particularly requests to /metadata/identity/oauth2/token endpoints. Implement DNS monitoring to flag lookups of rebinding services by ToolJet instances. Review recent RestAPI data source configurations and audit which users created or modified them.

Why prioritize this

This vulnerability should be prioritized for immediate patching because it combines high CVSS impact (8.3 HIGH), low attack complexity, no authentication barriers for free-tier users, and direct access to production credentials. The ability to extract managed identity tokens for an entire AKS cluster represents a complete compromise of cluster authentication. Any ToolJet deployment in Azure without additional segmentation should be treated as a critical patch candidate.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects a network-accessible vulnerability with low attack complexity and no required privileges. The scope change indicates the attacker can impact resources beyond the vulnerable component (the Kubernetes cluster and its workloads). The confidentiality, integrity, and availability impacts are all scored as LOW per the vector, though in practice, token theft enables HIGH-impact follow-on attacks. The score appropriately reflects the direct threat without crediting post-exploitation impact.

Frequently asked questions