CVE-2026-55454 Appsmith: Caddy admin API exposed without authentication
An authenticated user can exploit an unauthenticated Caddy admin API to replace the reverse proxy configuration, leading to potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55454?
CVE-2026-55454 is a critical missing authorization vulnerability in appsmithorg appsmith, published on 24 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
Which versions are affected by CVE-2026-55454?
1 open source package ship an affected version, including appsmith. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
appsmith Bitnami | All versions | 2.1.0 |
Products include Appsmith Appsmith.
How do I fix CVE-2026-55454?
Upgrade appsmith to 2.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-55454 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55454 exists.
Other vulnerabilities in appsmithorg appsmith
- CVE-2024-55964 Code injection in n/a
- CVE-2026-22794 Account Takeover Vulnerability in Appsmith
- CVE-2026-24042 Appsmith public apps can execute unpublished actions (viewMode confusion)
- CVE-2026-30862 Critical Stored XSS & Privilege Escalation in Appsmith
- CVE-2026-50189 Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
Sources
Also known as BIT-appsmith-2026-55454, GHSA-8jvv-gwqg-6vjc.