ETK-2026-3017Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3017",
  "cve_id": null,
  "display_id": "ETK-2026-3017",
  "ghsa_id": "GHSA-342c-q2qr-jxrj",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Server-side request forgery in Appsmith server",
  "summary": "Appsmith server versions before 2.4 can inadequately screen certain IPv6 transition-form destinations in REST API and GraphQL datasource actions. An authenticated user permitted to create or edit those actions may cause the server to reach restricted internal HTTP services and obtain their responses when the deployment's network provides applicable translation or relay connectivity.",
  "mitigation": "Upgrade com.appsmith:server to version 2.4 or later. Until then, restrict creation and editing of REST API and GraphQL datasource actions to trusted users.",
  "vendor": "maven",
  "product": "maven:com.appsmith:server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.4"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.4"
      ],
      "package_name": "com.appsmith:server",
      "purl": "pkg:maven/com.appsmith/server"
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 7.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 27.778967616666666,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T22:03:34+00:00",
      "days": -0.25703396796296296,
      "is_lower_bound": true,
      "measured_at": "2026-10-30T04:13:41.767382+00:00",
      "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-342c-q2qr-jxrj"
    }
  }
}