CVE Intelligence
Analysis AI-assisted

CVE-2026-55455: Appsmith SSRF via Weak Outbound Host Filter in HTTP Datasources

Appsmith versions before 2.1 contain a server-side request forgery (SSRF) weakness in the outbound host filter used by the REST API and GraphQL datasource plugins. The filter relies on an exact-match string denylist, so the broader address-class checks that exist on another code path (used by SMTP) are not applied to HTTP requests. The description states the issue is fixed in 2.1, and NVD lists a CVSS 3.1 base score of 9.1 (critical).

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-55455 is a server-side request forgery issue in Appsmith, a platform for building admin panels, internal tools and dashboards. According to the description, the outbound HTTP host filter in WebClientUtils validates hosts against an exact-match string denylist. The stronger address-class checks used on the SMTP path are not applied to the HTTP plugin path used by the REST API and GraphQL datasources. The weakness is classified as CWE-918.

Impact

  • The description states that an authenticated user can make outbound requests that reach services bound to loopback addresses inside the Appsmith container.
  • NVD scores the issue 9.1 (critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating high confidentiality and integrity impact over the network with low complexity and no user interaction.
  • The CNA entry (GitHub Security Advisories) lists a CVSS 4.0 score of 5.3. The sources do not explain the difference between the two scores.
  • The record does not describe which internal services exist in a given deployment, so the practical reach of the flaw depends on each installation.

Affected products and versions

  • Product: Appsmith (Appsmith Appsmith).
  • Affected range recorded: versions before 2.1 (< 2.1).
  • The record does not provide a list of specific intermediate builds or deployment types beyond this range.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Upgrade Appsmith to version 2.1 or later, as stated in the description. The record's fixes list is empty, so consult the GitHub Security Advisory to confirm the fixed release details.
  • Until the upgrade is applied, restrict which users can create or edit REST API and GraphQL datasources, since the description requires an authenticated user.
  • Review network egress policies for the Appsmith container so that it cannot reach sensitive internal services it does not need.
  • Limit access to services bound to loopback inside the container and avoid relying on loopback-only binding as the sole protection.

Detection guidance

  • Review audit logs and administrative activity for newly created or modified REST API and GraphQL datasources that point to unusual or internal destinations.
  • Monitor outbound connections from the Appsmith container for unexpected destinations, particularly local or internal addresses.
  • Check Appsmith version inventory to identify instances running a version earlier than 2.1.

Limitations of the available information

  • The record does not include a technical breakdown of the vulnerable code beyond the description, and this analysis does not add one.
  • The CVSS 3.1 and 4.0 scores come from different providers and are not reconciled in the sources.
  • The fixes list in the record is empty, so the fixed version is taken from the description text only.
  • No KEV, EPSS or SSVC data is available for this CVE in the record.

Frequently asked questions

Which Appsmith versions are affected by CVE-2026-55455?

The record lists Appsmith versions before 2.1 as affected. The description states the vulnerability is fixed in 2.1.

Does this vulnerability require authentication?

Yes. The description states that an authenticated user can craft the outbound requests, and the CVSS vector shows PR:N, which NVD reads as no privileges required; the sources do not reconcile these points beyond the description.

Is this CVE known to be actively exploited?

No. The KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.