CVE-2026-55455

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p	Third Party Advisory
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Appsmith es una plataforma para construir paneles de administración, herramientas internas y cuadros de mando. Antes de 2.1, el filtro de host HTTP saliente aplicado por WebClientUtils (utilizado por la API REST y los plugins de fuente de datos GraphQL) valida los hosts contra una lista de denegación de cadenas de coincidencia exacta. La verificación exhaustiva de clase de dirección (loopback, any-local, link-local, fc00::/7) existe solo en una ruta de código separada utilizada por SMTP, no por la ruta del plugin HTTP. Como resultado, un usuario autenticado puede elaborar solicitudes salientes que alcanzan servicios vinculados a loopback dentro del contenedor. Esta vulnerabilidad está corregida en 2.1.

Information

Published : 2026-06-24 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-55455

Mitre link : CVE-2026-55455

CVE.ORG link : CVE-2026-55455

JSON object : View

Products Affected

appsmith

appsmith

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-55455", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55455", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T13:04:48.487796Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "appsmithorg", "product": "appsmith", "versions": [{"status": "affected", "version": "< 2.1"}]}]}], "published": "2026-06-24T22:16:49.137", "references": [{"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1."}, {"lang": "es", "value": "Appsmith es una plataforma para construir paneles de administraci\u00f3n, herramientas internas y cuadros de mando. Antes de 2.1, el filtro de host HTTP saliente aplicado por WebClientUtils (utilizado por la API REST y los plugins de fuente de datos GraphQL) valida los hosts contra una lista de denegaci\u00f3n de cadenas de coincidencia exacta. La verificaci\u00f3n exhaustiva de clase de direcci\u00f3n (loopback, any-local, link-local, fc00::/7) existe solo en una ruta de c\u00f3digo separada utilizada por SMTP, no por la ruta del plugin HTTP. Como resultado, un usuario autenticado puede elaborar solicitudes salientes que alcanzan servicios vinculados a loopback dentro del contenedor. Esta vulnerabilidad est\u00e1 corregida en 2.1."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FE2EAB6-276F-426B-BDD2-BF6E6CCF5E60", "versionEndExcluding": "2.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}