What’s Vulnerable › Vulnerabilities

CVE-2024-42056

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-22 · updated 2026-06-17
• Weakness: CWE-532

Description

Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered (by an authenticated attacker) via the /api/resources endpoint. The earliest affected version is 3.18.1.

Affected products

• Retool: from 3.18.1 through 3.40.0

References

• https://docs.retool.com/disclosures/cve-2024-42056
• https://docs.retool.com/releases

Get alerted when CVE-2024-42056 or the next vulnerability affects your stack