appsmithorg/appsmith · error · UnknownHostException

Host {host} is not allowed

Error message

Host {host} is not allowed

What it means

The ElasticSearch plugin overrides Apache HttpAsyncClient's DnsResolver to enforce SSRF protection via RestrictedHostFilter. Before any DNS lookup, the hostname literal is checked against a blocklist: disallowed hostnames, blocked IP address classes (loopback, link-local 169.254/16, multicast, any-local 0.0.0.0, IPv6 Unique-Local fc00::/7), and the Appsmith instance's own hostnames/IPs. If the literal is disallowed, an UnknownHostException is thrown.

Source

Thrown at app/server/appsmith-plugins/elasticSearchPlugin/src/main/java/org/apache/http/impl/nio/client/HttpAsyncClientBuilder.java:658

     */
    public final HttpAsyncClientBuilder useSystemProperties() {
        systemProperties = true;
        return this;
    }

    private static String[] split(final String s) {
        if (TextUtils.isBlank(s)) {
            return null;
        }
        return s.split(" *, *");
    }

    public CloseableHttpAsyncClient build() {
        // This `dnsResolver` is the only thing different from the original class.
        // In the original class, it is set to SystemDefaultDnsResolver.INSTANCE, inlined.
        final DnsResolver dnsResolver = host -> {
            if (RestrictedHostFilter.isDisallowedAndFail(host, null)) {
                throw new UnknownHostException("Host " + host + " is not allowed");
            }
            final InetAddress[] addresses = InetAddress.getAllByName(host);
            for (InetAddress address : addresses) {
                if (RestrictedHostFilter.isDisallowedAndFail(address.getHostAddress(), null)) {
                    throw new UnknownHostException("Host " + host + " is not allowed");
                }
            }
            return addresses;
        };

        PublicSuffixMatcher publicSuffixMatcher = this.publicSuffixMatcher;
        if (publicSuffixMatcher == null) {
            publicSuffixMatcher = PublicSuffixMatcherLoader.getDefault();
        }

        NHttpClientConnectionManager connManager = this.connManager;
        if (connManager == null) {
            SchemeIOSessionStrategy sslStrategy = this.sslStrategy;

View on GitHub (pinned to 8cd9021c24)

Solutions

1. Use the external, routable hostname or IP of the ElasticSearch cluster.
2. If running locally in Docker, use the host's LAN IP or a Docker service name resolvable from the container, not localhost.
3. Ensure the host is not in a blocked address class — loopback, link-local, multicast, and ULA are always blocked.
4. If a legitimately internal cluster must be reached, consult Appsmith's network allow-list configuration or deploy behind a trusted network boundary.

Example fix

// before — loopback blocked by SSRF filter
dsConfig.setUrl("http://localhost:9200");

// after — routable address
dsConfig.setUrl("http://10.0.0.5:9200"); // or the cluster's public IP/host

import com.appsmith.util.RestrictedHostFilter;

URI uri = URI.create(dsConfig.getUrl());
String host = uri.getHost();
if (RestrictedHostFilter.isDisallowedAndFail(host, null)) {
    throw new IllegalArgumentException(
        "Host '" + host + "' is blocked by SSRF protection. Use a routable address.");
}

// Catch UnknownHostException from the ElasticSearch client build/connect:
try {
    client.execute(request);
} catch (UnknownHostException e) {
    if (e.getMessage().contains("is not allowed")) {
        log.warn("SSRF filter blocked host: {}", e.getMessage());
        return errorResult("Host is not allowed by SSRF protection.");
    }
    throw e;
}

When it happens

Trigger: The ElasticSearch datasource host is (or canonicalizes to) a loopback address like 127.0.0.1 or localhost, a link-local address like 169.254.169.254 (AWS metadata), an any-local address, an IPv6 ULA, or the Appsmith instance's own hostname or IP.

Common situations: Pointing ElasticSearch at localhost or 127.0.0.1 for local development; using the instance's internal hostname; attempting to reach the cloud metadata endpoint; using a link-local address in a containerized environment.

Related errors

• The ${path} path must start with 'https://'.
• Please enter a target origin URL.
• Please remove any direct/indirect references to {{actionName
• PE-PLG-5000
• PE-DSE-5003

AI-assisted analysis of appsmithorg/appsmith@8cd9021c24 (2026-08-12). Data as JSON: /api/errors/e50e00132162aab9. Report an issue: GitHub.