CVE-2026-50189: Appsmith Supervisord XML-RPC Remote Code Execution Vulnerability

Technical summary

Appsmith bundles supervisord with an XML-RPC listener on port 9001. Prior to version 2.1, this port is routed through Caddy at /supervisor/* on the public ingress without proper access controls. The supervisord password is retrievable by any authenticated administrator via GET /api/v1/admin/env. An attacker leveraging valid admin credentials can invoke supervisord's twiddler.addProgramToGroup XML-RPC method to define and execute arbitrary shell commands inside the container. The vulnerability combines improper exposure of a privileged service (CWE-183: Permissive List of Allowed Inputs) with server-side request forgery semantics (CWE-918: Server-Side Request Forgery) to achieve remote code execution with the privileges of the supervisord process.

Business impact

Compromise of an Appsmith instance enables complete control over the Docker container, including access to environment variables, configuration secrets, and any data processed by dashboards or tools running on the platform. Organizations using Appsmith to manage or display sensitive information face data exfiltration, unauthorized modifications to dashboards or tools, and potential lateral movement if the container has network access to other internal systems. The attack requires valid admin credentials but no user interaction, making it a persistent insider risk and a target for attackers who obtain or social-engineer admin access.

Affected systems

Appsmith versions prior to 2.1 are affected. This includes all instances deployed with the vulnerable bundled supervisord configuration. Organizations running Appsmith in containerized environments (Kubernetes, Docker Compose, Docker Swarm) or behind reverse proxies that expose the /supervisor/* route are directly at risk. The vulnerability does not affect versions 2.1 and later.

Exploitability

Exploitation requires valid Appsmith administrator credentials—a significant barrier but not a showstopper in scenarios involving compromised admin accounts, insider threats, or weak credential hygiene. No special network position, CVE-chains, or user interaction is required. Once credentials are obtained, the attack is straightforward: retrieve the supervisord password via a simple API call, craft an XML-RPC request to twiddler.addProgramToGroup, and execute shell commands. The attack surface is present as long as the /supervisor/* route remains accessible from untrusted networks.

Remediation

Upgrade Appsmith to version 2.1 or later, which remediates the underlying configuration and access control issues. Organizations unable to upgrade immediately should implement network-level controls: restrict access to the /supervisor/* route via firewall rules or reverse-proxy authentication, disable or isolate the supervisord service if it is not required for operations, and audit admin account activity and credential usage for signs of compromise.

Patch guidance

Appsmith version 2.1 and later include fixes for this vulnerability. Verify your current version using the version check in the Appsmith UI or by querying /api/v1/admin/version if accessible. Plan an upgrade following Appsmith's documented migration and deployment procedures. Test the upgrade in a non-production environment first to ensure compatibility with your dashboard configurations and dependencies. After upgrading, verify that supervisord is no longer accessible via the public /supervisor/* route by attempting to reach the endpoint and confirming a 404 or access-denied response.

Detection guidance

Monitor for HTTP requests to paths matching /supervisor/* in your reverse-proxy or ingress logs, particularly those originating from external IPs or unexpected internal sources. Audit admin API calls to GET /api/v1/admin/env for unusual patterns, especially if triggered by non-admin accounts or at unusual times. In containerized deployments, track supervisord process creation and program spawning via container logs and OS-level auditing. Inspect environment variable access logs and search for references to APPSMITH_SUPERVISOR_PASSWORD in authentication or API logs. If you identify suspicious supervisord activity, review the spawned processes and commands to determine the scope of any breach.

Why prioritize this

Although the vulnerability requires valid admin credentials, the combination of high impact (container code execution), simplicity of exploitation once credentials are obtained, and the common practice of sharing or reusing admin credentials in development and staging environments makes this a priority fix. High-privilege compromises often serve as springboards for lateral movement in enterprise environments.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects high severity impact—confidentiality, integrity, and availability of the container are all compromised—balanced against a high privilege requirement (PR:H, admin credentials). The score does not account for the exposure of the password via a GET endpoint, which lowers the practical barrier. The network-accessible vector (AV:N) and lack of user interaction (UI:N) contribute to the elevated score.

Frequently asked questions