CVE-2026-55455

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 2.1

Description An authenticated user can craft outbound requests that reach loopback-bound services inside the container. This occurs because the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist, whereas the comprehensive address-class check for loopback, any-local, link-local, and fc00::/7 is only implemented in the SMTP code path and not the HTTP plugin path.

Recommendations Update to version 2.1.