Outbound HTTP Loopback Access in Appsmith

Executive Summary

This vulnerability exists in Appsmith versions prior to 2.1, where the outbound HTTP host filter used by REST API and GraphQL datasource plugins only checks hosts against an exact-match denylist. Unlike the SMTP code path, it does not perform a comprehensive address-class check for loopback or local addresses. As a result, an authenticated user can craft outbound HTTP requests that reach loopback-bound services inside the container, potentially accessing internal services that should be protected.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an authenticated user to send outbound HTTP requests to loopback-bound services inside the container. This could lead to unauthorized access to internal services that are normally inaccessible from outside the container, potentially exposing sensitive internal data or functionality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Appsmith to version 2.1 or later, where the issue with the outbound HTTP host filter has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-55455 vulnerability allows authenticated users to bypass outbound HTTP host filters and access loopback-bound services inside the container. This can lead to unauthorized access to internal services and potentially full host takeover in certain Docker deployments.

Such unauthorized access and potential data exposure could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls on data access and protection of sensitive information.

Mitigations such as applying comprehensive IP address checks, network-level egress filtering, and disabling open signup are recommended to reduce the risk and help maintain compliance.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if an authenticated user can create or execute REST API actions that make outbound HTTP requests to loopback or local addresses inside the container, such as 0.0.0.0, 127.0.0.2, or [::].

To detect exploitation attempts or presence of this vulnerability, you can monitor or log outbound HTTP requests from the Appsmith instance targeting loopback or local IP addresses.

Suggested commands include inspecting network connections and HTTP requests from the Appsmith container or host.

• Use netstat or ss to check for unusual outbound connections to loopback addresses: `netstat -tnp | grep -E '127\.0\.0\.|0\.0\.0\.0|::1|::'` or `ss -tnp | grep -E '127\.0\.0\.|0\.0\.0\.0|::1|::'`
• Monitor HTTP request logs or Appsmith action logs for requests targeting loopback or local IPs, e.g., URLs like http://0.0.0.0:2019/config/
• Within the Appsmith interface, review REST API datasource actions for suspicious URLs pointing to internal IP addresses.

Additionally, network-level egress filtering can be used to block outbound requests to loopback or local IP ranges to prevent exploitation.

Useful 0 Not Useful 0