CVE-2026-55455

CriticalCVSS 9.1/10Last modified Jun 26, 2026

Description

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2026
Last modified: Jun 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-554577.4The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration CVE-2026-554597.4The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version CVE-2026-55466.3A flaw has been found in Campcodes Complete Online Learning Management System 1.0. This impacts the function add_lesson of the file /applica CVE-2026-554607.1Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but withou CVE-2026-554616.1Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled CVE-2026-554624.3Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing CVE-2026-554636.5The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version CVE-2026-554645.4Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Mar CVE-2026-554655.3The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version CVE-2026-554668.7Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image CVE-2026-554672.5OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob opt CVE-2026-554684.3Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective r