Critical severity · published Jun 24, 2026
CVE-2026-55455
Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
appsmith · appsmithorg
< 2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55455
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55455
Third Party Advisory
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p
More from appsmith
9.9
CVE-2026-55454
Appsmith: Caddy admin API exposed without authentication
9.8
CVE-2026-24042
Appsmith public apps can execute unpublished actions (viewMode confusion)
9.0
CVE-2026-30862
Critical Stored XSS & Privilege Escalation in Appsmith
8.8
CVE-2026-22794
Account Takeover Vulnerability in Appsmith
7.2
CVE-2026-50189
Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route