CVE-2026-55454: Appsmith SSRF Vulnerability

CVE-2026-55454 Overview

CVE-2026-55454 is a critical Server-Side Request Forgery (SSRF) vulnerability in Appsmith, an open-source platform for building admin panels, internal tools, and dashboards. The flaw exists in versions prior to 2.1, where the bundled Caddy reverse-proxy exposes its admin API on 0.0.0.0:2019 inside the container without authentication. Although this listener is not published to the host through docker-compose.yml, it remains reachable from the Appsmith server process. An authenticated low-privileged user can pivot through an SSRF primitive to issue administrative calls against the Caddy admin API, replacing the live reverse-proxy configuration. The issue is tracked under [CWE-749] and fixed in version 2.1.

Critical Impact
A low-privileged authenticated user can take over the Caddy reverse proxy by submitting POST /load requests through SSRF, fully replacing the live configuration and intercepting all proxied traffic.

Affected Products

Appsmith versions prior to 2.1
Bundled Caddy reverse-proxy admin API listener
Self-hosted Appsmith Docker deployments

Discovery Timeline

2026-06-24 - CVE-2026-55454 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-55454

Vulnerability Analysis

The vulnerability combines two weaknesses into a single exploitation chain. First, the bundled Caddy reverse-proxy binds its admin API to 0.0.0.0:2019 inside the container with no authentication enabled by default. Second, the Appsmith server process can be coerced into issuing arbitrary HTTP requests on behalf of an attacker through an SSRF primitive available to authenticated low-privileged users.

Because the Caddy admin listener accepts unauthenticated administrative calls from any origin that can reach it, the Appsmith application server itself becomes the trusted client. Attackers do not need to bypass network controls because the request originates inside the container boundary. This represents an exposed dangerous method or function [CWE-749].

Root Cause

The root cause is the insecure default exposure of the Caddy admin API combined with insufficient validation of outbound requests in the Appsmith server. The admin endpoint accepts configuration-replacing operations such as POST /load without verifying caller identity. The container security model assumed the listener was unreachable, but the SSRF path invalidates that assumption.

Attack Vector

An attacker authenticates to Appsmith with low privileges and triggers the SSRF vector to send an HTTP POST request to http://0.0.0.0:2019/load with attacker-controlled Caddy configuration JSON. The new configuration replaces the live reverse-proxy rules, allowing the attacker to redirect, intercept, or rewrite all traffic flowing through Caddy. The scope changes because compromise of the reverse proxy affects every downstream service it fronts.

No verified public proof-of-concept code is available. Technical details are documented in the GitHub Security Advisory GHSA-8jvv-gwqg-6vjc.

Detection Methods for CVE-2026-55454

Indicators of Compromise

Unexpected outbound HTTP requests from the Appsmith server process targeting 127.0.0.1:2019 or 0.0.0.0:2019.
Caddy configuration changes that do not correlate with deployment activity or administrative actions.
New upstream targets, route handlers, or TLS settings appearing in the running Caddy configuration.
Log entries showing POST /load, POST /config, or PATCH /config requests received by the Caddy admin API.

Detection Strategies

Audit Caddy admin API access logs for any request originating from the Appsmith server container.
Compare the running Caddy configuration with the version-controlled baseline at regular intervals.
Monitor container-internal traffic on TCP port 2019 and alert on any non-zero volume.
Review Appsmith application logs for low-privileged users invoking integrations that perform outbound HTTP requests to internal addresses.

Monitoring Recommendations

Enable verbose logging on the Caddy admin endpoint and forward logs to a centralized analytics platform.
Track authentication events for low-privileged Appsmith accounts paired with unusual API activity.
Alert on configuration drift events detected through periodic GET /config/ polling against a known-good snapshot.

How to Mitigate CVE-2026-55454

Immediate Actions Required

Upgrade Appsmith to version 2.1 or later, which contains the official fix.
Restrict the Caddy admin API listener to 127.0.0.1:2019 or disable it entirely if not required.
Audit existing Caddy configurations for unauthorized modifications introduced before patching.
Rotate credentials and session tokens for any Appsmith user account whose activity cannot be verified.

Patch Information

The vulnerability is fixed in Appsmith 2.1. Maintainers reconfigured the bundled Caddy instance and addressed the SSRF reachability of internal services. Refer to the GitHub Security Advisory GHSA-8jvv-gwqg-6vjc for full remediation guidance.

Workarounds

Bind the Caddy admin API to the container loopback interface by setting the admin directive to localhost:2019 in the Caddyfile.
Block intra-container traffic to TCP port 2019 using network policies or iptables rules where supported.
Limit Appsmith integration capabilities for low-privileged roles to prevent arbitrary outbound HTTP requests.

bash

# Configuration example: restrict Caddy admin API to loopback
# In Caddyfile global options block
{
    admin 127.0.0.1:2019
}