ETK-2026-3020Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3020",
  "cve_id": null,
  "display_id": "ETK-2026-3020",
  "ghsa_id": "GHSA-x3j2-rfj9-cc32",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Server-side request forgery in Appsmith server",
  "summary": "Appsmith server versions before 2.4 can be induced to issue requests to internal network destinations despite the default destination filter. An authenticated user with permission to create or edit REST API or GraphQL datasource actions may access responses from reachable internal services.",
  "mitigation": "Upgrade Appsmith server to version 2.4 or later. Until upgraded, restrict creation and editing of REST API and GraphQL datasource actions to trusted users.",
  "vendor": "maven",
  "product": "maven:com.appsmith:server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.4"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.4"
      ],
      "package_name": "com.appsmith:server",
      "purl": "pkg:maven/com.appsmith/server"
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 39.4915527,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T22:00:21+00:00",
      "days": -0.26954657809027777,
      "is_lower_bound": true,
      "measured_at": "2026-10-30T04:28:29.854657+00:00",
      "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-x3j2-rfj9-cc32"
    }
  }
}