CVE-2026-43910 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-43910HIGH

Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  L  N    8.2   .0024   15.3     —

AFFECTED
  Product      Versions              Fixed
  java-client  >= 8.2.1, < 10.1.1 –  —

TIMELINE
  May 4   Reserved by GitHub_M
  Jul 28  EXPLOIT PUBLISHED — CVE-2026-43910 (appium java-client). Public exploit reference added.
  Jul 28  Published (CNA: GitHub_M)

CWE-441, CWE-918 · CNA: GitHub_M · CVSS v3.1 · 4 references · NVD status: Analyzed

Description

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost, directConnectPort, and directConnectPath fields from the server's NEW_SESSION response and rebuilds the client's server URL from them, validating only that the protocol is https, with no host allowlist or IP validation; a rogue or compromised server can therefore redirect all subsequent session traffic to an arbitrary destination, enabling full interception of session traffic and a server-side request forgery pivot to internal hosts, including cloud metadata (IMDS) credential theft. This vulnerability is fixed in 10.1.1.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 4, 2026	Reserved	Reserved by GitHub_M
July 28, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-43910 (appium java-client). Public exploit reference added.
July 28, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
appium	java-client	—	>= 8.2.1, < 10.1.1	—

Weaknesses

CWE-441 · CWE-918

References (4)

https://github.com/appium/java-client/commit/2b9cd442b9dbf56ccc6f1e83aeeb411c0ec230c9 [Patch]
https://github.com/appium/java-client/pull/2408 [Issue Tracking, Patch]
https://github.com/appium/java-client/releases/tag/v10.1.1 [Release Notes]
https://github.com/appium/java-client/security/advisories/GHSA-28f5-38xr-jh2w [Exploit, Vendor Advisory]

Authoritative record: CVE-2026-43910 at cve.org

Vendors: appium

Weaknesses: CWE-441 · CWE-918

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43910 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.