What is CVE-2026-55455?

CVE-2026-55455 is a critical-severity vulnerability in Appsmith, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.1/10. Published 2026-06-24.

How severe is CVE-2026-55455?

Critical severity. CVSS v3 base score is 9.1 out of 10.

SSRF in Appsmith

CVE-2026-55455

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published 2026-06-24 · last modified 2026-06-26.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.004 (30.3th percentile), scored 2026-09-28.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 30.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Appsmith
Appsmithorg Appsmith — versions < 2.1

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

github.com/appsmithorg/appsmith/security/advisories/GHSA-m23h-pvf3-2m7p (Third Party Advisory)

Frequently asked questions

What is CVE-2026-55455?: CVE-2026-55455 is a critical-severity vulnerability in Appsmith, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.1/10. Published 2026-06-24.
How severe is CVE-2026-55455?: Critical severity. CVSS v3 base score is 9.1 out of 10.