Executive brief
Appsmith is a platform used by businesses to build internal tools, admin panels, and dashboards. A security flaw in its internal web server configuration allows an attacker with low-level access to take complete control of the system's traffic management. This could lead to the theft of sensitive database credentials, encryption keys, and administrative sessions, effectively allowing an attacker to hijack the entire platform and the data it manages.
Technical details
The bundled Caddy reverse proxy in Appsmith (prior to version 2.1) binds its administrative API to 0.0.0.0:2019 without authentication. While not exposed to the public internet by default, the API is reachable via Server-Side Request Forgery (SSRF) or through Kubernetes service meshes if metrics are enabled. An authenticated attacker can use an SSRF vulnerability to issue a POST /load request to the Caddy API, replacing the proxy configuration. This allows for traffic interception, exfiltration of environment variables (including APPSMITH_ENCRYPTION_PASSWORD and database credentials), and potential remote code execution. The issue is resolved in version 2.1 by binding the admin API to the loopback interface.
Affected products
- Appsmith Appsmith Community Edition (Docker/Helm) <= 2.0
- Appsmith Appsmith Enterprise Edition (Docker/Helm) <= 2.0
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published by Appsmith
- 2026-06-24: disclosed: CVE-2026-55454 published to NVD
- 2026-06-24: patched: Fix released in version 2.1