CVE-2026-43910 Appium CVE debrief

Who should care

Developers and administrators using Appium Java Client versions from 8.2.1 until 10.1.1 should be aware of this vulnerability and take necessary actions to mitigate it. Affected operators, platforms, and security teams should review the vulnerability and implement necessary controls. Vulnerability management and security teams should prioritize this vulnerability due to its high severity and potential impact on session traffic and server-side request forgery. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring and detection logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. Asset inventory and source tracking should be used to identify and manage affected systems. Rollback/change windows should be considered for remediation. Security audits and vulnerability assessments should be performed regularly to identify potential vulnerabilities. Security teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should also consider compensating controls for exposed systems while remediation is scheduled and verified. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should check relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should also consider compensating controls for exposed

Technical summary

The Appium Java Client vulnerability (CVE-2026-43910) exists in versions from 8.2.1 until 10.1.1, where directConnect(true) is enabled. The client's server URL is rebuilt from the server's NEW_SESSION response, validating only the https protocol, without host allowlist or IP validation. This allows a rogue or compromised server to redirect session traffic to an arbitrary destination, enabling full interception and server-side request forgery.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows for full interception of session traffic and server-side request forgery.

Recommended defensive actions

• Update Appium Java Client to version 10.1.1 or later
• Disable directConnect(true) if not required
• Implement host allowlist or IP validation for directConnectHost, directConnectPort, and directConnectPath fields
• Monitor session traffic for suspicious activity
• Perform regular security audits and vulnerability assessments

Evidence notes

The vulnerability exists in Appium Java Client versions from 8.2.1 until 10.1.1, where directConnect(true) is enabled. The client's server URL is rebuilt from the server's NEW_SESSION response, validating only the https protocol, without host allowlist or IP validation. This allows a rogue or compromised server to redirect session traffic to an arbitrary destination, enabling full interception and server-side request forgery.

Official resources