CVE-2026-5418 Details
Description
A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A server-side request forgery (SSRF) vulnerability has been identified in Appsmith versions through 1.97. The issue arises in the WebClientUtils class, specifically within the computeDisallowedHosts function, which fails to properly validate user-supplied URLs before the server makes outbound HTTP requests. This oversight allows requests to private IP ranges, internal cluster service names, or localhost, potentially leading to unauthorized access of internal services or information disclosure.
Users are advised to upgrade to Appsmith version 1.99, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 2, 2026CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appsmithorg/appsmith/ | [email protected] | Vendor |
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-9m89-5jw7-q5cr | [email protected] | AdvisoryRemedyVendor |
| https://vuldb.com/submit/780190 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/vuln/354855 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/vuln/354855/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appsmithorg appsmith | <= 1.97 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |