CVE-2026-55455 Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
Authenticated users can bypass host restrictions to access internal loopback services via REST or GraphQL plugins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55455?
CVE-2026-55455 is a medium-severity server-side request forgery vulnerability in appsmithorg appsmith, published on 24 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.
Weakness: CWE-918
Which versions are affected by CVE-2026-55455?
1 open source package ship an affected version, including appsmith. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
appsmith Bitnami | All versions | 2.1.0 |
Products include Appsmith Appsmith.
How do I fix CVE-2026-55455?
Upgrade appsmith to 2.1.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-55455 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55455 exists.
Other vulnerabilities in appsmithorg appsmith
- CVE-2026-55454 Appsmith: Caddy admin API exposed without authentication
- CVE-2024-55964 Code injection in n/a
- CVE-2026-22794 Account Takeover Vulnerability in Appsmith
- CVE-2026-24042 Appsmith public apps can execute unpublished actions (viewMode confusion)
- CVE-2026-30862 Critical Stored XSS & Privilege Escalation in Appsmith
Sources
Also known as BIT-appsmith-2026-55455, GHSA-m23h-pvf3-2m7p.