CVE-2026-50189

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 2.1

Description The bundled supervisord exposes an XML-RPC interface on port 9001, which is accessible from outside the container through a Caddy reverse-proxy route at the '/supervisor/*' endpoint. An authenticated administrator can retrieve the APPSMITH SUPERVISOR PASSWORD variable via the 'GET /api/v1/admin/env' endpoint. By combining these, an attacker can send arbitrary XML-RPC calls to supervisord and execute operating system commands within the Docker container using the twiddler.addProgramToGroup() function.

Recommendations Update to version 2.1.