Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-50189

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the public ingress. Combined with the APPSMITH_SUPERVISOR_PASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup. This vulnerability is fixed in 2.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 18.7%
CVSS Severity
CVSS v3 Score 7.2
Products affected by CVE-2026-50189


Contact Us

Shodan ® - All rights reserved