CVE-2026-55455CWE-918

Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist

Medium · published June 24, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00388 · 31.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-24T21:36Z
EPSS history
Timeline
  • 24 JUN 21:36Z
    Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
    cvelistv5