Host Header Injection Vulnerability in Retool Self-Hosted Versions
CVE-2025-47424

7.1HIGH

Key Information:

Vendor

Retool

Status
Retool
Vendor
CVE Published:
9 May 2025

What is CVE-2025-47424?

The Retool self-hosted application prior to version 3.196.0 is vulnerable to a Host header injection attack. This issue arises when the BASE_DOMAIN environment variable is not configured, allowing attackers to manipulate the HTTP host header. Exploitation of this vulnerability can lead to unauthorized actions or malicious payload delivery within the application.

Affected Version(s)

Retool 3.18.1 <= 3.18.23

Retool 3.20.1 <= 3.20.18

Retool 3.22.1 <= 3.22.21

References

https://docs.retool.com/disclosures/cve-2025-47424

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.