Analytical use of cookies
CVE-2026-55454: appsmith vulnerability
CVE-2026-55454: critical vulnerability affecting appsmith. Check CVSS, KEV status, business impact and recommended administrator actions.
- CVSS
- 9.9 CRITICAL
- EPSS
- 31.78%
- Known exploited
- not in KEV
- Product
- appsmith
What is known
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
Business impact
Successful exploitation of CVE-2026-55454, a critical vulnerability (CVSS 9.9) affecting appsmith, may affect the confidentiality, integrity or availability of the vulnerable environment. The exact impact depends on the installed version, exposed interfaces and deployment configuration.
Recommended administrator action
Confirm whether appsmith is present and compare installed versions with the vendor advisory and NVD record. Apply the vendor patch or documented mitigation; until remediation is complete, reduce exposure of affected interfaces, review relevant logs and monitor for indicators of exploitation. DataHouse can support version verification, managed patching, network exposure reduction, log review and backup validation for dedicated, cloud and colocated environments.