SSRF in Appium Java-client
CVE-2026-43910
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directCon…
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N.
Affected products
- Appium Java-client — versions >= 8.2.1, < 10.1.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-43910?
- CVE-2026-43910 is a high-severity vulnerability in Appium Java-client, classified under Unintended Proxy or Intermediary (Confused Deputy). CVSS score: 8.2/10. Published 2026-07-28.
- How severe is CVE-2026-43910?
- High severity. CVSS v3 base score is 8.2 out of 10.