# CVE-2026-50189: Appsmith OS command execution via supervisord XML-RPC interface

Source: https://junglewise.ai/threats/cve-2026-50189-appsmith-os-command-execution-via-supervisord-xml-rpc-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-50189 · Severity: info · CVSS 8.9 · Published 2026-06-24

Appsmith is a platform used to build internal business tools and dashboards. A security flaw allows an authenticated administrator to execute arbitrary operating system commands on the server hosting the application. This could lead to a full takeover of the Appsmith environment, unauthorized access to sensitive internal data, and disruption of business operations.

Technologies: [Appsmith](https://junglewise.ai/threats/technologies/appsmith). Vendors: [Appsmith](https://junglewise.ai/threats/vendors/appsmith).

## Quick answers

**Is CVE-2026-50189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50189 being exploited in the wild.

**How severe is CVE-2026-50189?** Informational severity, with a CVSS score of 8.9, published 24 June 2026.

**Which products and versions are affected?** Appsmith < 2.1.

**Is there a fix for CVE-2026-50189?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50189 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50189?** Check whether you run Appsmith at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Appsmith versions prior to 2.1 contain a remote code execution vulnerability due to the exposure of the bundled supervisord XML-RPC interface. The interface, which runs on port 9001, is accessible from outside the container via a Caddy reverse-proxy route at /supervisor/*. An authenticated administrator can retrieve the required 'APPSMITH_SUPERVISOR_PASSWORD' from the /api/v1/admin/env endpoint. By sending a crafted XML-RPC call to the 'twiddler.addProgramToGroup' method, an attacker can register and execute arbitrary shell commands as the 'appsmith' user within the container. This issue is resolved in version 2.1.

## Affected products

- Appsmith Appsmith < 2.1

## Timeline

- 2026-06-12: advisory: GitHub security advisory published by Appsmith
- 2026-06-24: disclosed: CVE-2026-50189 published to NVD

## References

- [https://github.com/appsmithorg/appsmith/security/advisories/GHSA-v49v-673j-g4vj](https://github.com/appsmithorg/appsmith/security/advisories/GHSA-v49v-673j-g4vj)

## Related threats

- [Appsmith stored XSS in SQL query editor autocomplete](https://junglewise.ai/threats/cve-2026-7299-appsmith-stored-xss-in-sql-query-editor-autocomplete)
- [Appsmith SSRF in WebClientUtils via improper host validation](https://junglewise.ai/threats/cve-2026-5418-appsmith-ssrf-in-webclientutils-via-improper-host-validation)
- [Appsmith missing authentication in instance management API endpoints](https://junglewise.ai/threats/cve-2026-34411-appsmith-missing-authentication-in-instance-management-api)