Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-55454: Appsmith: Unauthenticated Access to Reverse Proxy API
CVE-2026-55454
BIT-appsmith-2026-55454
Summary
Appsmith's built-in reverse proxy had no password protection, allowing a malicious user to take control of the proxy and potentially harm the system. This issue has been fixed in version 2.1. Users should update to the latest version to prevent exploitation.
What to do
- Update appsmith to version 2.1.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | appsmith |
< 2.1.0 Fix: upgrade to 2.1.0
|
Original title
Appsmith: Caddy admin API exposed without authentication
Original description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
nvd CVSS3.1
9.9
Vulnerability type
CWE-749
CWE-1188
Published: 29 Jun 2026 · Updated: 23 Jul 2026 · First seen: 24 Jun 2026