CVE-2026-55455 Details
Description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.
A server-side request forgery (SSRF) vulnerability has been identified in Appsmith versions prior to 2.1. This issue arises in the outbound HTTP host filtering applied by WebClientUtils, which is utilized by the REST API and GraphQL datasource plugins. The filter only checks against an exact-match string denylist, leaving a gap that allows authenticated users to send requests to loopback-bound services within the container. This vulnerability is not present in version 2.1.
Users can upgrade to Appsmith version 2.1 or apply network-level egress filtering to block connections from the Appsmith container to localhost or loopback on non-application ports. Disabling open signup can also help mitigate the risk by requiring an admin invitation to gain access.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p | CISA-ADP | Third Party Advisory |
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appsmith appsmith | < 2.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |