CVE-2026-2274

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker to read sensitive local files and access internal network resources via crafted requests to the production cluster.

This vulnerability was patched and no customer action is needed.

Metrics

CVSS 4.0 8.5/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Feb 19, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-227406.5A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, tempCVE-2026-227413.1Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can CVE-2026-227428.6Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing CVE-2026-227437.5Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled CVE-2026-227447.5In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strinCVE-2026-227455.3Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an applicCVE-2026-227463.7Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked CVE-2026-227478.1Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN valuCVE-2026-227486.5Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it CVE-2026-22759.6The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function cCVE-2026-227507.5When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently iCVE-2026-227514.8Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulner