Is there a patch available for CVE-2026-55455?

Yes, a patch is available for CVE-2026-55455. Update the affected software to the latest version immediately.

Appsmith CVE-2026-55455

Q: What is the CVSS score of CVE-2026-55455?

CVE-2026-55455 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39111 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-24 GitHub_M

SSRF Appsmith Appsmithorg

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Network-exploitable with authenticated low-privilege access; scope changes to internal container services justify S:C, with low C and I reflecting limited service probing impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 23:03 EUVD

Analysis Generated

Jun 24, 2026 - 22:27 vuln.today

DescriptionCVE.org

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.

AnalysisAI

Server-side request forgery in Appsmith prior to version 2.1 allows authenticated users to reach loopback-bound services inside the deployment container by exploiting a split code path in host validation logic. The WebClientUtils component used by REST API and GraphQL datasource plugins enforces only an exact-match string denylist, while the comprehensive address-class check covering loopback, any-local, link-local, and fc00::/7 IPv6 ranges exists solely on the SMTP plugin code path - leaving the HTTP path bypassable. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

Appsmith is an open-source low-code platform (CPE: cpe:2.3:a:appsmithorg:appsmith:*:*:*:*:*:*:*:*) that allows users to build admin panels and internal dashboards by connecting to external datasources including REST APIs, GraphQL endpoints, and SMTP servers. The vulnerability is rooted in CWE-918 (Server-Side Request Forgery), a class of flaw where a server-side component makes outbound HTTP requests controlled by user input without sufficiently validating the destination. The specific root cause is architectural inconsistency: the WebClientUtils class validates outbound HTTP destinations using an exact-match string denylist, while a separate, more robust check that evaluates IP address class membership - blocking loopback (127.0.0.0/8, ::1), any-local, link-local, and the fc00::/7 ULA IPv6 range - was implemented only for the SMTP plugin path. This denylist-only approach on the HTTP path is inherently weaker because string matching fails to account for alternative IP encodings, IPv6 representations, and canonicalization variations that resolve to blocked ranges.

RemediationAI

Upgrade Appsmith to version 2.1 or later, which introduces the comprehensive address-class validation (loopback, any-local, link-local, fc00::/7) on the HTTP plugin code path in WebClientUtils, closing the denylist bypass. The fix is detailed in GitHub Security Advisory GHSA-m23h-pvf3-2m7p at https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p. If immediate upgrade is not possible, compensating controls include restricting which Appsmith user roles are permitted to create or edit REST API and GraphQL datasource configurations, thereby reducing the population of users who can exploit the bypass. Network-level egress filtering on the container host to block outbound connections from Appsmith to 127.0.0.0/8, ::1, 169.254.0.0/16, and fc00::/7 provides a defense-in-depth layer, though this may interfere with legitimate internal datasource connectivity and should be tested before production deployment.