CVE-2026-43910

Name of the Vulnerable Software and Affected Versions Appium Java Client versions 8.2.1 through 10.1.0

Description When directConnect(true) is enabled, the setDirectConnect() function in AppiumCommandExecutor.java reads the directConnectHost, directConnectPort, and directConnectPath fields from the server's NEW SESSION response to rebuild the client's server URL. Because the client only validates that the protocol is https and lacks a host allowlist or IP validation, a compromised server can redirect all subsequent session traffic to an arbitrary destination. This can lead to full interception of session traffic and server-side request forgery (SSRF), allowing a network pivot to internal hosts and the theft of cloud metadata (IMDS) credentials.

Recommendations Update Appium Java Client to version 10.1.1. As a temporary workaround, avoid enabling directConnect(true) until the update is applied.