https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:21:46.484954+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-50189 CVE-2026-50189 — Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route 2026-10-03T21:21:46.500867+00:00

Affected: appsmithorg appsmith

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the public ingress. Combined with the APPSMITH_SUPERVISOR_PASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup. This vulnerability is fixed in 2.1.