← Vulnerability feed

Vulnerability record · CVE-2026-55454 · published 24 June 2026

CVE-2026-55454: Appsmith insecure default initialization vulnerability

Appsmith · Appsmith

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.

9.9 CVSS 3.1 Critical EPSS 0.60% · top 53.3% CWE-749 · CWE-749CWE-1188 · Insecure default initialization
9.9CVSS 3.1 base score
0.60%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
26 Jun 2026Last modified by NVD

Description

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-8jvv-gwqg-6vjc ExploitThird Party Advisory
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-8jvv-gwqg-6vjc ExploitThird Party Advisory

Track CVE-2026-55454 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-24042Appsmith missing authorization vulnerabilityAppsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthentica…EPSS 0.65%9.8CVE-2024-55964Appsmith code injection vulnerabilityAn issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command executio…EPSS 6.8%9.0CVE-2026-30862Appsmith cross-site scripting vulnerabilityAppsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table …EPSS 0.45%8.9CVE-2026-50189Appsmith server-side request forgery (ssrf) vulnerabilityAppsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interfa…EPSS 0.49%8.9CVE-2022-39824Appsmith cross-site scripting vulnerabilityServer-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the curr…EPSS 1.1%8.8CVE-2026-22794Appsmith origin validation error vulnerabilityAppsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request header…EPSS 0.39%8.8CVE-2022-38298Appsmith server-side request forgery (ssrf) vulnerabilityAppsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests t…EPSS 0.72%6.9CVE-2026-34411Appsmith missing authentication for critical function vulnerabilityAppsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoi…EPSS 0.45%

Source: NIST National Vulnerability Database (record CVE-2026-55454), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.