A critical vulnerability, CVE-2026-55454, has been identified in Appsmith versions prior to 2.1 and the bundled Caddy reverse-proxy. The vulnerability stems from the Caddy admin API, which lacks default authentication and is bound to 0.0.0.0:2019 within the container. Although this listener is not directly exposed by the docker-compose.yml configuration, it is accessible via the Appsmith server process or through a Server Side Request Forgery (SSRF) vulnerability. An authenticated low-privileged user can exploit this to send POST requests to http://0.0.0.0:2019/, allowing them to modify the live Caddy configuration and potentially achieve remote code execution. This poses a significant risk to systems using affected versions of Appsmith and Caddy with default settings. The CVSS score of 9.9 indicates a critical severity level. Users are strongly advised to upgrade to Appsmith 2.1 or later and ensure that Caddy configurations are secured with proper authentication mechanisms to mitigate this risk.