Is CVE-2026-55454 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55454 being exploited in the wild.

How severe is CVE-2026-55454?

Critical severity, with a CVSS score of 9.9, published 24 June 2026.

Which products and versions are affected?

Appsmith Community Edition <= 2.0; Appsmith Enterprise Edition <= 2.0.

Is there a fix for CVE-2026-55454?

A patch was published on 2026-06-24: Fix released in version 2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55454 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55454?

Check whether you run Appsmith Community Edition or Appsmith Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55454: Appsmith unauthenticated Caddy admin API exposure

Q: Is there a fix for CVE-2026-55454?

A patch was published on 2026-06-24: Fix released in version 2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55454 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55454?

Check whether you run Appsmith Community Edition or Appsmith Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55454 · Severity: critical · CVSS 9.9 · Published 2026-06-24

Appsmith is a platform used by businesses to build internal tools, admin panels, and dashboards. A security flaw in its internal web server configuration allows an attacker with low-level access to take complete control of the system's traffic management. This could lead to the theft of sensitive database credentials, encryption keys, and administrative sessions, effectively allowing an attacker to hijack the entire platform and the data it manages.

Technologies: Appsmith Community Edition. Vendors: Appsmith.

Quick answers

Is CVE-2026-55454 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55454 being exploited in the wild.
How severe is CVE-2026-55454?: Critical severity, with a CVSS score of 9.9, published 24 June 2026.
Which products and versions are affected?: Appsmith Community Edition <= 2.0; Appsmith Enterprise Edition <= 2.0.
Is there a fix for CVE-2026-55454?: A patch was published on 2026-06-24: Fix released in version 2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55454 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55454?: Check whether you run Appsmith Community Edition or Appsmith Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The bundled Caddy reverse proxy in Appsmith (prior to version 2.1) binds its administrative API to 0.0.0.0:2019 without authentication. While not exposed to the public internet by default, the API is reachable via Server-Side Request Forgery (SSRF) or through Kubernetes service meshes if metrics are enabled. An authenticated attacker can use an SSRF vulnerability to issue a POST /load request to the Caddy API, replacing the proxy configuration. This allows for traffic interception, exfiltration of environment variables (including APPSMITH_ENCRYPTION_PASSWORD and database credentials), and potential remote code execution. The issue is resolved in version 2.1 by binding the admin API to the loopback interface.

Affected products

Appsmith Appsmith Community Edition (Docker/Helm) <= 2.0
Appsmith Appsmith Enterprise Edition (Docker/Helm) <= 2.0

Timeline

2026-06-12: advisory: GitHub Security Advisory published by Appsmith
2026-06-24: disclosed: CVE-2026-55454 published to NVD
2026-06-24: patched: Fix released in version 2.1

References

https://github.com/appsmithorg/appsmith/security/advisories/GHSA-8jvv-gwqg-6vjc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.