CVE-2026-43910: java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
When directConnect(true) is enabled, appium/java-client unconditionally
accepts directConnectHost, directConnectPort, and directConnectPath
from the server’s NEW_SESSION response and silently redirects all subsequent
session traffic to the attacker-specified endpoint — with no allowlist,
no host validation, and no user notification.
References
- github.com/advisories/GHSA-28f5-38xr-jh2w
- github.com/appium/java-client/commit/2b9cd442b9dbf56ccc6f1e83aeeb411c0ec230c9
- github.com/appium/java-client/pull/2408
- github.com/appium/java-client/releases/tag/v10.1.1
- github.com/appium/java-client/security/advisories/GHSA-28f5-38xr-jh2w
- nvd.nist.gov/vuln/detail/CVE-2026-43910
Code Behaviors & Features
Detect and mitigate CVE-2026-43910 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →