HIGH 8.2 GitHub
CVE-2026-43910
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
## Summary
When `directConnect(true)` is enabled, appium/java-client unconditionally
accepts `directConnectHost`, `directConnectPort`, and `directConnectPath`
from the server's NEW_SESSION response and silently redirects all subsequent
session traffic to the attacker-specified endpoint — with no allowlist,
no host validation, and no user notification.
## Affected Code
- `AppiumCommandExecutor.java` (line 196–219): `setDirectConnect()` builds
a new URL from server-supplied fields and calls `
Affected Products
- maven/io.appium:java-client >= 8.2.1, <= 10.1.0
References
- https://github.com/advisories/GHSA-28f5-38xr-jh2w
- https://github.com/appium/java-client/security/advisories/GHSA-28f5-38xr-jh2w
- https://github.com/appium/java-client/pull/2408
- https://github.com/appium/java-client/commit/2b9cd442b9dbf56ccc6f1e83aeeb411c0ec230c9
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-07-28 via GitHub. Affected: maven/io.appium:java-client >= 8.2.1, <= 10.1.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.