{
 "slug": "appsmith",
 "name": "Appsmith",
 "tagline": "Low-code platform for building internal tools, admin panels and dashboards",
 "category": "developer-platform",
 "use_cases": [
  "internal-tools",
  "admin-panels",
  "low-code"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Appsmith",
  "url": "https://www.appsmith.com",
  "license": "Apache-2.0",
  "license_url": "https://github.com/appsmithorg/appsmith/blob/release/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "v2.5.1",
   "last_build": "2026-10-24",
   "entity_id": "prod-7pmula2lm3jxc",
   "ami_alias": "/aws/service/marketplace/prod-7pmula2lm3jxc/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-legnzoyem24ye",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "v2.4",
   "last_build": "2026-09-14",
   "offer_id": "appsmith",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:appsmith:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.appsmith?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/appsmith/",
  "json": "https://lynxroute.com/products/appsmith/product.json"
 },
 "release_notes": [
  {
   "version": "v2.5.1",
   "title": "Appsmith v2.5.1",
   "notes": "* Appsmith Community Edition updated v2.4 -> v2.5.1 (includes v2.4.1 - v2.4.3 and v2.5.0). Apache-2.0 unchanged\n* Security: bundled dependency updates for reported vulnerabilities (including netty-handler and Bouncy Castle), stricter datasource permission checks, SMTP restricted-host enforcement, Elasticsearch input validation and a per-IP limit on self-serve signup\n* Upgrade notes: changing a datasource connection setting now requires re-entering its credentials, Git-connected apps move to schema 13, and customised docker.env files must hold literal values\n* New: optional application descriptions, Table header wrapping and styling, a List widget Disable selection option and a Rich Text Editor font control\n* Self-registration still closes automatically once the first admin account exists; telemetry stays disabled\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-24"
   }
  },
  {
   "version": "v2.4",
   "title": "Appsmith v2.4",
   "notes": "* Appsmith Community Edition updated to v2.4 (from v2.3) - low-code platform for internal tools and admin panels. Apache-2.0 unchanged\n* Adds an opt-in Model Context Protocol (MCP) server so compatible AI clients can build and edit applications through a permission-checked tool API. It is off by default on new installs and upgrades alike, uses per-user keys that expire, and requires human confirmation for destructive operations\n* Microsoft SQL Server data sources gain read-only connections, including readable-secondary routing for Always On deployments\n* Security: admin API responses now mask sensitive values, custom JavaScript library manifests require application read permission, Git routes check permissions before using stored credentials, OAuth data source flows can no longer redirect to a different origin, and restricted-host checks now cover alternate IPv4 and IPv6 forms\n* Reminder: Appsmith AI data sources stop working on 30 September 2026. Move any remaining queries to a direct OpenAI, Anthropic or Google AI data source; this release refreshes the model lists for all three\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-11",
    "azure": "2026-09-14"
   }
  },
  {
   "version": "v2.3",
   "title": "Appsmith v2.3",
   "notes": "* Appsmith Community Edition updated to v2.3 (from v2.2) - low-code platform for internal tools and admin panels. Apache-2.0 unchanged\n* Ask AI is now available in the Community Edition, and Custom Widgets gain a native AI Copilot; a new Card widget displays entities with a composable body canvas\n* Appsmith AI data sources are deprecated: new ones can no longer be created after this upgrade, and existing ones stop working on 30 September 2026\n* Security: fixes a datasource authorization bypass on application import and fork, symlink path traversal during Git import, permission groups crossing workspace boundaries, an open redirect on login, and an overly permissive frame-ancestors default\n* FIXED: self-registration now really closes once the first account is created. Appsmith's own signup-disabled setting does not take effect on v2.3, so new accounts could still be created on an instance whose setup notes said registration was closed. Registration is now refused at the web server in front of the application, which does not depend on that setting. Inviting teammates is unaffected\n* Registering the first account no longer restarts the application, removing a roughly five-minute outage that used to happen immediately after setup\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-28",
    "azure": "2026-08-28"
   }
  },
  {
   "version": "v2.2",
   "title": "Appsmith v2.2 - July 2026",
   "notes": "* Appsmith Community Edition v2.2 on Ubuntu 24.04 LTS - version bump from v2.1\n* Per-instance encryption keys and database passwords generated at first boot\n* First signup becomes the Instance Administrator; further signups auto-close\n* HTTPS enabled by default (self-signed); set a custom domain for built-in Let's Encrypt\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-20",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "v2.1",
   "title": "Appsmith v2.1 - Initial release (June 2026)",
   "notes": "* Appsmith Community Edition v2.1 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Per-instance encryption keys and database passwords generated at first boot\n* First signup becomes the Instance Administrator; further signups auto-close\n* HTTPS enabled by default (self-signed); set a custom domain for built-in Let's Encrypt\n* Embedded MongoDB, PostgreSQL and Redis bound to localhost inside the container\n* Anonymous telemetry disabled\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-19",
    "azure": "2026-06-29"
   }
  }
 ],
 "release_history": [
  {
   "version": "v2.5.1",
   "aws": "2026-10-24"
  },
  {
   "version": "v2.4",
   "aws": "2026-09-11",
   "azure": "2026-09-14"
  },
  {
   "version": "v2.3",
   "aws": "2026-08-28",
   "azure": "2026-08-28"
  },
  {
   "version": "v2.2",
   "aws": "2026-07-20",
   "azure": "2026-07-27"
  },
  {
   "version": "v2.1",
   "aws": "2026-06-19",
   "azure": "2026-06-29"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-7pmula2lm3jxc/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer appsmith --plan payg-gen2\naz vm create -g my-rg -n appsmith --size Standard_D2s_v3 \\\n  --image lynxroute:appsmith:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Appsmith is an open-source low-code platform for building internal tools - admin panels, dashboards, CRUD apps, support consoles and approval workflows - without writing front-end code. You drag and drop from 45+ pre-built UI widgets (tables, forms, charts, lists, modals), bind them to data with a visual query editor, and add logic in plain JavaScript anywhere a value is accepted. It ships as a single all-in-one stack: a Java application server with an embedded MongoDB metadata store, PostgreSQL, and Redis, fronted by a Caddy reverse proxy. Appsmith connects to 25+ data sources, including PostgreSQL, MySQL, Microsoft SQL Server, MongoDB, Snowflake, Redis, Amazon S3, Google Sheets, REST APIs and GraphQL. Self-hosted means your apps, queries and data stay inside your own AWS account. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* Per-instance secrets - the encryption keys and the embedded MongoDB, PostgreSQL and Redis passwords are generated at first boot, never baked into the image\n* No administrator account baked in - the first user to sign up becomes the Instance Administrator, and a background service disables further signups automatically once the first admin is registered\n* HTTPS enabled by default with a self-signed certificate (in-container Caddy reverse proxy); set a custom domain to switch to a built-in Let's Encrypt certificate\n* Embedded MongoDB, PostgreSQL and Redis bound to localhost inside the container - never exposed on the network\n* Anonymous usage telemetry disabled\n* UFW firewall pre-configured - only TCP 22, 80, 443 are exposed\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nNOTES\n\nThe full Appsmith stack (application metadata, your apps, and uploads) persists on a dedicated data volume across container restarts and instance reboots. On first launch the platform initializes its embedded databases, which takes a few minutes; a loading page is shown until it is ready. To move off the self-signed certificate, set APPSMITH_CUSTOM_DOMAIN to your domain in /etc/appsmith/appsmith.env to enable the built-in Let's Encrypt integration, then restart the service."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}