CVE-2026-55454: Appsmith: Caddy admin API exposed without authentication

Synopsis

An authentication-bypass-via-SSRF vulnerability in Appsmith allows an authenticated low-privileged user to reach the bundled Caddy reverse-proxy admin API, which listens on 0.0.0.0:2019 inside the container with no authentication of its own. The attacker drives a server-side request forgery (SSRF) from the Appsmith server process to issue arbitrary admin API calls against Caddy, fully replacing its live configuration. Successful exploitation gives the attacker complete control over the reverse proxy, enabling traffic interception, redirection, and credential theft across all traffic the proxy handles. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Appsmith application over the network to authenticate and trigger the SSRF that proxies requests to the internal Caddy admin API.

• AuthenticationRequired

  Any low-privilege account in Appsmith is sufficient; no admin rights are needed to drive the SSRF toward the unauthenticated Caddy admin endpoint.

• Victim interactionNot required

  No victim action is required; the attacker makes direct API calls to Appsmith and the SSRF is triggered entirely by the attacker.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions or special memory layout are required, just valid low-privilege credentials and knowledge of the internal Caddy admin path.

Blast Radius

• Attacker replaces the live Caddy reverse-proxy configuration, redirecting all proxied HTTP/S traffic to attacker-controlled destinations and intercepting credentials and session tokens in transit.
• Attacker can disable TLS termination or inject malicious upstream definitions, breaking service availability for every application behind the reverse proxy.
• With full Caddy config control, the attacker can exfiltrate internal routing topology and backend service addresses that would otherwise be invisible to a low-privileged user.
• Scope is marked Changed in the CVSS vector, meaning impact extends beyond the Appsmith container itself to any backend services and users whose traffic passes through the compromised proxy.