PT-2026-65502 · Unknown · Io.Appium:Java-Client

CVE-2026-43910 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Appium Java Client versions 8.2.1 through 10.1.0

Description When directConnect(true) is enabled, the setDirectConnect() function in AppiumCommandExecutor.java reads the directConnectHost, directConnectPort, and directConnectPath fields from the server's NEW SESSION response to rebuild the client's server URL. Because the client only validates that the protocol is https and lacks a host allowlist or IP validation, a compromised server can redirect all subsequent session traffic to an arbitrary destination. This can lead to full interception of session traffic and server-side request forgery (SSRF), allowing a network pivot to internal hosts and the theft of cloud metadata (IMDS) credentials.

Recommendations Update Appium Java Client to version 10.1.1. As a temporary workaround, avoid enabling directConnect(true) until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

CWE-441

Related Identifiers

CVE-2026-43910

GHSA-28F5-38XR-JH2W

Affected Products

Io.Appium:Java-Client

References · 7

• 🔥 https://github.com/appium/java-client/security/advisories/GHSA-28f5-38xr-jh2w · Exploit
• https://osv.dev/vulnerability/GHSA-28f5-38xr-jh2w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43910 · Security Note
• https://github.com/appium/java-client · Note
• https://github.com/appium/java-client/commit/2b9cd442b9dbf56ccc6f1e83aeeb411c0ec230c9 · Note
• https://github.com/appium/java-client/releases/tag/v10.1.1 · Note
• https://github.com/appium/java-client/pull/2408 · Note