Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M

CVE-2026-55455Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist

Medium 5.3

In plain English

A medium-severity server-side request forgery in appsmith from appsmithorg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.

Affected products (as reported)

Vendor	Product	Versions
appsmithorg	appsmith	< 2.1

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p x_refsource_CONFIRM