CVE-2026-50189
High · 7.2CVSS
7.2
EPSS
0.5%
Published
Jun 24, 2026
CISA due date
—
The record
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the public ingress. Combined with the APPSMITH_SUPERVISOR_PASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup. This vulnerability is fixed in 2.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-183
- CVE-2026-54694 SkillTree is a micro-learning gamification platform. CWE-183
- CVE-2026-55581 mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. CWE-183
- CVE-2026-63649 The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through… CWE-183
- CVE-2026-67315 axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as… CWE-183
- CVE-2026-46608 Glances is an open-source system cross-platform monitoring tool. CWE-183
- CVE-2026-54316 Claude Code is an agentic coding tool. CWE-183
- CVE-2026-8918 A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to… CWE-183