appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts falsificación de solicitud del lado del servidor

The SSRF vulnerability in Appsmith allows an attacker to craft malicious requests that originate from the Appsmith server itself. This can be exploited to access internal services and resources that are not directly accessible from the outside world. For example, an attacker could potentially access internal APIs, databases, or other sensitive systems. The ability to make requests as the server opens up a broad attack surface. Given the availability of a public exploit, the risk of exploitation is elevated, and organizations using vulnerable versions of Appsmith should prioritize remediation. The potential for data exfiltration and lateral movement within the network is significant.

Organizations deploying Appsmith in environments with internal services accessible via HTTP or HTTPS are at risk. This includes deployments where Appsmith is used to integrate with internal APIs or databases. Shared hosting environments where Appsmith instances share the same network infrastructure are particularly vulnerable, as a successful exploit could potentially compromise other systems on the same network.

• linux / server:

journalctl -u appsmith -g 'computeDisallowedHosts' | grep -i error

• generic web:

curl -I <appsmith_url>/api/v1/dashboards/some_dashboard | grep -i 'Server:'

• generic web:

curl -I <appsmith_url>/api/v1/dashboards/some_dashboard | grep -i 'X-Powered-By:'

1. 2026-04-02Disclosure

   disclosure

2. 2026-04-02Patch

   patch

1. Reservado2026-04-02
2. Publicada2026-04-02
3. Modificada2026-04-03
4. EPSS actualizado2026-04-10

The primary mitigation for CVE-2026-5418 is to upgrade Appsmith to version 1.99 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. These may include restricting outbound network access from the Appsmith server using a firewall or proxy. Carefully review and restrict the allowed domains for outbound requests within Appsmith's configuration. Implement strict input validation on any user-supplied data that is used to construct URLs. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability using known exploit techniques and verifying that the requests are blocked.