CVE-2026-50189: Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/ on the public ingress. Combined with the APPSMITHSUPERVISORPASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup. This vulnerability is fixed in 2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Appsmithto a version that resolves this vulnerability.Fixed in 2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50189?
The severity of CVE-2026-50189 is rated as high with a CVSS score of 8.9.
How do I fix CVE-2026-50189?
To fix CVE-2026-50189, update to Appsmith version 2.1 or later where the XML-RPC interface is not exposed externally.
What type of vulnerability is CVE-2026-50189?
CVE-2026-50189 is a remote code execution (RCE) vulnerability due to the exposure of the Supervisord XML-RPC admin interface.
What systems are affected by CVE-2026-50189?
CVE-2026-50189 affects versions of Appsmith prior to 2.1 that have the Supervisord XML-RPC interface exposed.
How does CVE-2026-50189 impact application security?
CVE-2026-50189 can allow an attacker to execute arbitrary code on the server due to the unprotected XML-RPC interface.