CVE-2026-55454: Appsmith: Caddy admin API exposed without authentication
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Appsmithto a version that resolves this vulnerability.Fixed in 2.1 - Compensating control
Ensure the bundled Caddy admin API listener on 0.0.0.0:2019 inside the container is not reachable from the Appsmith server process itself or from any SSRF paths (network-isolate or restrict access to the admin API endpoint so it cannot be driven by an authenticated low-privileged user).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55454?
The severity of CVE-2026-55454 is critical with a score of 9.9.
What vulnerability does CVE-2026-55454 exploit?
CVE-2026-55454 exploits the lack of authentication on the Caddy admin API bundled with Appsmith.
How do I mitigate CVE-2026-55454?
To mitigate CVE-2026-55454, upgrade Appsmith to version 2.1 or later where the vulnerability is addressed.
What impact does CVE-2026-55454 have on my system?
CVE-2026-55454 may allow unauthorized access to sensitive administrative controls, leading to potential data exposure and manipulation.
Is there any workaround for CVE-2026-55454 before upgrading?
As a temporary workaround for CVE-2026-55454, consider binding the Caddy admin API to a specific interface rather than 0.0.0.0.