CVE-2026-43910 in java-client
Summary
by MITRE • 07/28/2026
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost, directConnectPort, and directConnectPath fields from the server's NEW_SESSION response and rebuilds the client's server URL from them, validating only that the protocol is https, with no host allowlist or IP validation; a rogue or compromised server can therefore redirect all subsequent session traffic to an arbitrary destination, enabling full interception of session traffic and a server-side request forgery pivot to internal hosts, including cloud metadata (IMDS) credential theft. This vulnerability is fixed in 10.1.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The Appium Java Client vulnerability stems from improper validation of server redirection parameters within the direct connect functionality that was present between versions 8.2.1 and 10.1.1. When developers enable the directConnect(true) feature, the AppiumCommandExecutor.setDirectConnect() method processes the NEW_SESSION response from the Appium server to extract three critical fields: directConnectHost, directConnectPort, and directConnectPath. This implementation fundamentally compromises network security by relying solely on protocol validation for https connections while completely omitting any host allowlisting or IP address verification mechanisms. The vulnerability represents a classic case of insufficient input validation and trust model design flaws that create opportunities for man-in-the-middle attacks and lateral movement within network environments.
The technical flaw manifests as an incomplete validation process that accepts redirection parameters without proper security checks, allowing malicious actors to manipulate the connection flow by injecting false host information into the server response. This weakness operates at the protocol level where the client blindly trusts the server's response without verifying that the target host belongs to the expected service or falls within acceptable network boundaries. The absence of host validation creates a path for attackers to redirect all subsequent session traffic through arbitrary endpoints, effectively enabling complete traffic interception and manipulation capabilities. This vulnerability aligns with CWE-284 (Improper Access Control) and CWE-310 (Cryptographic Issues) categories, as it undermines both access control mechanisms and secure communication protocols.
The operational impact of this vulnerability extends beyond simple traffic interception to include sophisticated attack vectors that can compromise entire cloud infrastructure. An attacker who gains the ability to manipulate the directConnectHost field can redirect client communications to internal systems, including cloud metadata services such as AWS Instance Metadata Service or Azure Instance Metadata Service, which often contain sensitive credential information and system configuration data. This capability transforms a simple network redirection into a full server-side request forgery (SSRF) attack that can be used to enumerate internal resources, extract credentials, and potentially escalate privileges within cloud environments. The vulnerability creates a pivot point for attackers to move laterally across networks and access systems that would otherwise be protected by network segmentation.
The mitigation strategy requires immediate upgrade to version 10.1.1 or later where the vulnerability has been addressed through proper validation of host parameters and implementation of secure redirection mechanisms. Organizations should also implement network-level controls such as firewall rules and DNS filtering to prevent unauthorized connections to internal services, while monitoring for unusual traffic patterns that might indicate exploitation attempts. The fix demonstrates the importance of proper input validation and trust model design in client-server architectures, particularly when dealing with dynamic service discovery and connection management. This vulnerability highlights the critical need for security considerations in API client implementations and serves as a reminder that seemingly benign features like direct connect can create significant attack surface when not properly secured against malicious redirection attempts.