CVE-2026-5418: appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery
A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
appsmithorg appsmith Dashboard (WebClientUtils.java computeDisallowedHosts)to a version that resolves this vulnerability.Fixed in 1.99
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5418?
CVE-2026-5418 is classified as a medium severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2026-5418?
To fix CVE-2026-5418, upgrade the Appsmith application to version 1.98 or later.
Which versions of Appsmith are affected by CVE-2026-5418?
CVE-2026-5418 affects Appsmith versions up to and including 1.97.
What kind of vulnerability is CVE-2026-5418?
CVE-2026-5418 is a server-side request forgery (SSRF) vulnerability found in the computeDisallowedHosts function.
Where can I find more information about CVE-2026-5418?
For more information about CVE-2026-5418, refer to official security advisories and documentation from Appsmith.