Remote Code Execution Risk in Appium Java Client by Appium
CVE-2026-43910

8.2HIGH

Key Information:

Vendor

Appium

Status
Java-client
Vendor
CVE Published:
28 July 2026

What is CVE-2026-43910?

The Appium Java Client, specifically in versions from 8.2.1 to 10.1.1, has a vulnerability when the directConnect feature is enabled. The AppiumCommandExecutor retrieves the server's NEW_SESSION response and generates the client’s server URL using the directConnectHost, directConnectPort, and directConnectPath without adequate validation of the server's identity. Consequently, this flaw enables an attacker to redirect session traffic to arbitrary destinations, exposing the application to session interception and server-side request forgery. This vulnerability can potentially lead to the theft of sensitive credentials, such as cloud metadata through internal hosts. The issue has been addressed and resolved in version 10.1.1.

Affected Version(s)

java-client >= 8.2.1, < 10.1.1

References

https://github.com/appium/java-client/security/advisories...
x_refsource_CONFIRM
https://github.com/appium/java-client/pull/2408
x_refsource_MISC
https://github.com/appium/java-client/commit/2b9cd442b9db...
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.