Vulnerability · Published Feb 19, 2026 · Assigned by GoogleCloud

CVE-2026-2274Arbitrary File Read and SSRF in Google AppSheet

High 8.5

In plain English

A high-severity server-side request forgery in AppSheet Web (Main Server) from AppSheet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker to read sensitive local files and access internal network resources via crafted requests to the production cluster. This vulnerability was patched and no customer action is needed.

Affected products (as reported)

Vendor	Product	Versions
AppSheet	AppSheet Web (Main Server)	0 – before 2025-11-23

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear

References

https://discuss.google.dev/t/november-23-2025/332118