CVE-2026-43910: java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandE…

Summary When directConnect(true) is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEW_SESSION response and silently redirects all subse…

8.2CVSS Score

HIGHSeverity

NOCISA KEV

VulnerabilityImpact Type

📋 Vulnerability Details

CVE ID	CVE-2026-43910
Vendor	maven
Affected Product	io.appium:java-client
Vulnerability Type	Vulnerability
CVSS Score	8.2 (HIGH)
Actively Exploited	❌ No known exploitation
Patch Status	See Vendor Advisory →
Reported By	CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories)

🔬 Technical Analysis

Summary When `directConnect(true)` is enabled, appium/java-client unconditionally

accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEW_SESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no host validation, and no user notification.

Affected Code - `AppiumCommandExecutor.java` (line 196–219): `setDirectConnect()` builds a new URL from server-supplied fields and calls `overrideServerUrl(newUrl)` without validating host/IP.

• DirectConnect.java: getUrl() constructs protocol://host:port/path with no allowlist.

Root Cause Only the protocol is validated (must equal "https"). The destination host

and port are never checked against any allowlist or denylist.

PoC

📚 Advisory References

⚡ DETECTION RULES AVAILABLE

Get CVE-2026-43910 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries

🛡️ Get Detection Pack → 🔌 Access via API →