CVE-2026-43910 is a CWE-441 (Unintended Proxy or Intermediary) vulnerability in the Appium Java Client affecting versions from 8.2.1 until 10.1.1. When the directConnect(true) option is enabled, the AppiumCommandExecutor.setDirectConnect() method reads directConnectHost, directConnectPort, and directConnectPath from the server's NEW_SESSION response and reconstructs the client server URL. The only validation performed is that the protocol is HTTPS; there is no host allowlist or IP validation. This allows a malicious or compromised server to redirect all subsequent session traffic to an arbitrary destination, enabling full interception of session traffic and server-side request forgery pivots to internal hosts, including cloud metadata services (IMDS), potentially leading to credential theft. The vulnerability is resolved in version 10.1.1.

An attacker controlling or compromising the Appium server can exploit this vulnerability to redirect client session traffic to arbitrary destinations, enabling interception and manipulation of session data. This can facilitate server-side request forgery attacks to internal network hosts, including cloud metadata services, potentially resulting in credential theft. The vulnerability has a high CVSS score of 8.2, indicating significant confidentiality impact and partial integrity impact, but no availability impact. No known exploits in the wild have been reported.

This vulnerability is fixed in Appium Java Client version 10.1.1. Users should upgrade to version 10.1.1 or later to remediate this issue. Until upgrading, users should consider disabling directConnect(true) to avoid triggering the vulnerable code path. Patch status is not explicitly confirmed beyond the fix in 10.1.1; users should consult the official Appium project advisories for the latest remediation guidance.