Executive brief
Appium Java Client is a library used by developers to write automated tests for mobile and desktop applications. A security flaw allows a malicious or compromised Appium server to redirect all subsequent test traffic to an arbitrary destination without the user's knowledge. This could lead to the theft of sensitive session data or allow an attacker to reach internal network services, including cloud credential metadata, by using the testing machine as a jumping-off point.
Technical details
A Server-Side Request Forgery (SSRF) and 'Confused Deputy' vulnerability exists in the Appium Java Client from version 8.2.1 until 10.1.1. When the 'directConnect' feature is enabled, the AppiumCommandExecutor.setDirectConnect() method processes directConnectHost, directConnectPort, and directConnectPath fields from a server's NEW_SESSION response. The client rebuilds its server URL using these fields without performing host allowlist or IP validation, verifying only that the protocol is HTTPS. An attacker-controlled server can exploit this to redirect all subsequent session traffic to an arbitrary destination, enabling full traffic interception or a network pivot to internal resources (RFC-1918) and cloud metadata services (IMDS). The issue is resolved in version 10.1.1 by adding additional security checks to the overrideServerUrl API.
Affected products
- Appium java-client >= 8.2.1, < 10.1.1
Timeline
- 2026-04-19: patched: Fix committed to master branch
- 2026-04-20: patched: Version 10.1.1 released
- 2026-07-27: advisory: GitHub Security Advisory published
- 2026-07-28: disclosed: CVE published to NVD