A critical vulnerability, CVE-2026-55454, has been identified in Appsmith versions prior to 2.1 and the bundled Caddy reverse-proxy. The vulnerability stems from the Caddy admin API, which lacks default authentication and is bound to 0.0.0.0:2019 within the container. Although this listener is not directly exposed by the docker-compose.yml configuration, it is accessible via the Appsmith server process or through a Server Side Request Forgery (SSRF) vulnerability. An authenticated low-privileged user can exploit this to send POST requests to http://0.0.0.0:2019/, allowing them to modify the live Caddy configuration and potentially achieve remote code execution. This poses a significant risk to systems using affected versions of Appsmith and Caddy with default settings. The CVSS score of 9.9 indicates a critical severity level. Users are strongly advised to upgrade to Appsmith 2.1 or later and ensure that Caddy configurations are secured with proper authentication mechanisms to mitigate this risk.
CRITICAL
CVSS 9.9
CVE-2026-55454
2026-08-22
Critical Vulnerability in Appsmith and Caddy Allows Remote Code Execution (CVE-2026-55454)
A critical vulnerability in Appsmith and Caddy allows an authenticated user to take over the Caddy configuration, leading to remote code execution. Affected versions are prior to Appsmith 2.1 and Caddy with default settings.