Executive brief
Appsmith, a platform for building internal business tools and dashboards, contains a security flaw in how it handles outbound web requests. An authorized user can bypass security filters to send requests to internal services running on the same server that should normally be inaccessible. This could allow an attacker to access sensitive internal configuration data or, if combined with other vulnerabilities, take control of the host server.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Appsmith's WebClientUtils component. The outbound HTTP host filter uses an exact-match string denylist rather than comprehensive address-class validation (e.g., loopback, link-local, or any-local checks). Authenticated users can bypass these filters using alternative loopback representations like '0.0.0.0', '127.0.0.2', or '[::]'. This allows attackers to reach loopback-bound services inside the container, such as internal admin APIs. The vulnerability is fixed in version 2.1 by implementing proper IP address class resolution and validation.
Affected products
- Appsmith Appsmith Community Edition <= 2.0
- Appsmith Appsmith Enterprise Edition <= 2.0
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD