Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-55455: Appsmith before 2.1 allows loopback access to services
CVE-2026-55455
BIT-appsmith-2026-55455
Summary
Appsmith, a platform for building internal tools and dashboards, had a security issue before version 2.1. This issue allowed an authenticated user to access internal services within the same container. The issue has been fixed in version 2.1, so make sure to update your Appsmith installation if you're using an earlier version.
What to do
- Update appsmith to version 2.1.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | appsmith | appsmith |
< 2.1 cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:* |
| Bitnami | – | appsmith |
< 2.1.0 Fix: upgrade to 2.1.0
|
Original title
Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
Original description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.
nvd CVSS4.0
5.3
Vulnerability type
CWE-918
Server-Side Request Forgery (SSRF)
Published: 29 Jun 2026 · Updated: 20 Jul 2026 · First seen: 24 Jun 2026