CVE-2026-55455 is a critical server-side request forgery flaw (CVSS 9.1) in Appsmith before 2.1. The host filter for the REST API and GraphQL datasources uses an exact match denylist, so a signed-in user can craft requests that reach loopback services inside the container. Upgrade to Appsmith 2.1.
What's affected
- Appsmith before 2.1, per the record.
- Fixed in 2.1.
- The REST API and GraphQL datasource plugins, which use the outbound HTTP filter in WebClientUtils. The record says an authenticated user is needed.
How to check if you're exposed
Read the Appsmith version in the application or from the container image tag, and compare it with 2.1. Then list who can create datasources or queries, since they can send outbound requests from the server. Check which services listen on loopback inside the container, and whether they hold anything sensitive.
What to do now
- Upgrade Appsmith to 2.1 or later.
- Restrict who can create REST API and GraphQL datasources and queries.
- Run the container with network policies that limit outbound traffic to the destinations the apps need.
- Make sure internal services bound to loopback require their own authentication.
Why it matters
The class is CWE-918, server-side request forgery. The advisory explains that the filter compared hostnames against a list of exact strings. A fuller check for loopback, link-local and unique local address classes existed only on the path used for SMTP, so the HTTP path had the weaker check.
Denylists of strings are easy to get around, because one address can be written many ways. A better design resolves the name and tests the address class on every request path. The record does not mark the CVE as exploited in the wild.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do anonymous visitors reach it?
The record says an authenticated user is needed.
Sources
Last reviewed: 19 October 2026.
