CVE-2026-55454 Details
Description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
A vulnerability exists in Appsmith versions through 2.0, where the bundled Caddy reverse proxy's admin API is exposed without authentication. The API is bound to 0.0.0.0:2019 inside the container, making it accessible from the Appsmith server process or through a server-side request forgery (SSRF) vulnerability. An authenticated low-privileged user can exploit this to issue POST requests to the admin API, replacing the live Caddy configuration and taking control of the reverse proxy.
Users can upgrade to Appsmith version 2.1 or later, bind the admin endpoint to 127.0.0.1, and ensure that the Helm chart's metrics service does not target the admin port.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-8jvv-gwqg-6vjc | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-8jvv-gwqg-6vjc | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appsmith appsmith | < 2.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |