Read the docs
TI-2026-31973 Aliases CVE-2026-43910GHSA-28f5-38xr-jh2w

Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Priority HIGH 69CWE-441Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost, directConnectPort, and directConnectPath fields from the server's NEW_SESSION response and rebuilds the client's server URL from them, validating only that the protocol is https, with no host allowlist or IP validation; a rogue or compromised server can therefore redirect all subsequent session traffic to an arbitrary destination, enabling full interception of session traffic and a server-side request forgery pivot to internal hosts, including cloud metadata (IMDS) credential theft. This vulnerability is fixed in 10.1.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed java-client (appium): 10.1.1io.appium:java-client (Maven): 10.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
appiumjava-client8.2.1 to before 10.1.110.1.1Patch availableCNA
—io.appium:java-client (Maven)8.2.1 to before 10.1.110.1.1Patch availableGHSA-28f5-38xr-jh2w
  • java-client Vendorappium Affected 8.2.1 to before 10.1.1 Fixed in 10.1.1 Patch available CNA
  • io.appium:java-client (Maven) Vendor— Affected 8.2.1 to before 10.1.1 Fixed in 10.1.1 Patch available GHSA-28f5-38xr-jh2w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:appium:java-client:*:*:*:*:*:*:*:*8.2.1 to before 10.1.1Vulnerableappium
  • cpe:2.3:a:appium:java-client:*:*:*:*:*:*:*:* Versions 8.2.1 to before 10.1.1 Vulnerable ·appium

Remediation

  • Fix · CNA java-client (appium) Fixed in 10.1.1
  • Fix · GHSA-28f5-38xr-jh2w io.appium:java-client (Maven) Fixed in 10.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43910
  2. 2026-10-03 Alias added: GHSA-28f5-38xr-jh2w

References

Exploit 1

Patch 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences