BIT-appsmith-2026-55454
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/appsmith/BIT-appsmith-2026-55454.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-appsmith-2026-55454
- Aliases
-
- CVE-2026-55454
- GHSA-8jvv-gwqg-6vjc
- Published
- 2026-06-29T05:37:57.360Z
- Modified
- 2026-07-08T08:26:30.682931749Z
- Summary
- Appsmith: Caddy admin API exposed without authentication
- Details
-
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
- Database specific
{ "cpes": [ "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*" ], "severity": "Critical" }- References
Affected packages
Bitnami / appsmith
Package
- Name
- appsmith
- Purl
- pkg:bitnami/appsmith
Severity
- 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator