CVE-2026-50189 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-50189HIGH

appsmithorg appsmith — Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   H   N   H   H   H    8.9   .0033   25.5     —

AFFECTED
  Product   Versions  Fixed
  appsmith  < 2.1 –   —

TIMELINE
  Jun 3   Reserved by GitHub_M
  Jun 24  EXPLOIT PUBLISHED — CVE-2026-50189 (appsmithorg appsmith). Public exploit reference added.
  Jun 24  Published (CNA: GitHub_M)

CWE-183, CWE-918 · CNA: GitHub_M · CVSS v4.0 · 1 reference · NVD status: Analyzed

Description

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the public ingress. Combined with the APPSMITH_SUPERVISOR_PASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup. This vulnerability is fixed in 2.1.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 3, 2026	Reserved	Reserved by GitHub_M
June 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-50189 (appsmithorg appsmith). Public exploit reference added.
June 24, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
appsmithorg	appsmith	—	< 2.1	—

Weaknesses

CWE-183 · CWE-918

References (1)

https://github.com/appsmithorg/appsmith/security/advisories/GHSA-v49v-673j-g4vj [Exploit, Third Party Advisory]

Authoritative record: CVE-2026-50189 at cve.org

Vendors: appsmithorg

Weaknesses: CWE-183 · CWE-918

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-50189 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.