What is CVE-2026-55455?

CVE-2026-55455 is a critical-severity vulnerability in Appsmith, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.1/10. Published 2026-06-24.

How severe is CVE-2026-55455?

Critical severity. CVSS v3 base score is 9.1 out of 10.

SSRF in Appsmith

CVE-2026-55455

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-matc…

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.002 (12.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Appsmith
Appsmithorg Appsmith — versions < 2.1

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2026-55455?: CVE-2026-55455 is a critical-severity vulnerability in Appsmith, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.1/10. Published 2026-06-24.
How severe is CVE-2026-55455?: Critical severity. CVSS v3 base score is 9.1 out of 10.