CVE-2026-43910: 
Java vulnerability analysis and mitigation

CVE-2026-43910 is a Server-Side Request Forgery (SSRF) and Confused Deputy vulnerability in the Appium Java Client (io.appium:java-client) that allows a rogue or compromised Appium server to redirect all subsequent session traffic to an arbitrary attacker-controlled destination. When directConnect(true) is enabled, the client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath values from the server's NEW_SESSION response without validating the destination host or port. Affected versions are >= 8.2.1 and <= 10.1.0; the vulnerability is fixed in version 10.1.1. It was published on July 27–28, 2026, and carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory, Feedly).

The root cause lies in AppiumCommandExecutor.java (lines 196–219), where setDirectConnect() builds a new URL from server-supplied fields (directConnectHost, directConnectPort, directConnectPath) and calls overrideServerUrl(newUrl) with no host/IP allowlist validation — only the protocol (must be https) is checked. This maps to CWE-441 (Unintended Proxy or Intermediary / Confused Deputy) and CWE-918 (SSRF). An attacker controlling or compromising the Appium server can inject arbitrary values into the NEW_SESSION response, causing the Java client to silently redirect all subsequent WebDriver session commands (e.g., GET /session/{id}/source, DELETE /session/{id}) to the attacker's endpoint. A confirmed PoC was included in the advisory, demonstrating redirection to https://127.0.0.1:4443/wd/hub with no client-side warning (Github Advisory, Fix PR).

Successful exploitation enables full interception of Appium session traffic, including session tokens, credentials, and sensitive test data, without any user notification. The vulnerability also enables network pivoting to internal RFC-1918 hosts and cloud Instance Metadata Service (IMDS) endpoints (e.g., 169.254.169.254), facilitating cloud credential theft. In CI/CD environments where directConnect(true) is set in shared base configurations, the blast radius is significantly elevated, as all test sessions could be silently compromised (Github Advisory, Feedly).

1. Set up a rogue Appium server: Deploy a malicious server that mimics a legitimate Appium endpoint and listens for incoming POST /wd/hub/session (NEW_SESSION) requests.
2. Inject malicious directConnect fields: Craft the NEW_SESSION response to include directConnectHost, directConnectPort, and directConnectPath pointing to an attacker-controlled host (e.g., directConnectHost=attacker.example.com, directConnectPort=4443, directConnectPath=/wd/hub).
3. Lure the victim client: Cause a Java test client with directConnect(true) enabled to connect to the rogue server — for example, by poisoning CI/CD configuration, DNS, or via a man-in-the-middle position on the network.
4. Capture redirected session traffic: Once the client processes the NEW_SESSION response, all subsequent WebDriver commands (e.g., GET /wd/hub/session/{id}/source, DELETE /wd/hub/session/{id}) are silently sent to the attacker's endpoint, exposing session tokens, credentials, and test data.
5. Pivot to internal resources (optional): Set directConnectHost=169.254.169.254 to redirect session traffic to the cloud IMDS endpoint, enabling theft of IAM credentials or other cloud metadata (Github Advisory).

• Network: Unexpected outbound HTTPS connections from the Appium Java client to IP addresses or hostnames not matching the configured Appium server; connections to RFC-1918 addresses (e.g., 10.x.x.x, 192.168.x.x, 172.16-31.x.x) or 169.254.169.254 originating from the test runner process.
• Logs: Appium client logs showing directConnect redirection to an unexpected host/port after session creation; log entries such as Injecting directConnect -> https://<unexpected-host>:<port>/wd/hub.
• Process: Java test runner process making HTTP requests to hosts not in the expected Appium server allowlist, particularly to loopback (127.0.0.1) or link-local addresses.
• CI/CD: Unexpected session command failures or responses from unknown endpoints in CI/CD pipeline logs when directConnect(true) is enabled in shared test configurations (Github Advisory).

Upgrade io.appium:java-client to version 10.1.1, which introduces the DirectConnectUrlSafety helper class that validates override URLs and rejects loopback, link-local (including 169.254.x.x), unspecified, and multicast destinations before calling overrideServerUrl() (v10.1.1 Release, Fix PR). As a workaround for those unable to upgrade immediately, disable directConnect(true) unless strictly necessary. Additionally, implement network-level egress controls to restrict the test client from connecting to unauthorized Appium servers or internal metadata endpoints, and monitor client logs for unexpected directConnect redirects (Github Advisory).

The vulnerability was reported by security researcher RobertoLuzanilla and published via GitHub Security Advisory on July 27–28, 2026. The fix was developed by Appium maintainer mykola-mokhnach and reviewed by multiple code owners, with the patch merged on April 19, 2026 (prior to public disclosure). No significant broader media coverage or notable social media reactions have been identified beyond the advisory and standard vulnerability database aggregation (Github Advisory, Fix PR).