What is the CVSS score of EUVD-2026-49879?

EUVD-2026-49879 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-49879?

Yes, a patch is available for EUVD-2026-49879. Update the affected software to the latest version immediately.

Java EUVD-2026-49879

| CVE-2026-43910 HIGH

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-07-28 https://github.com/appium/java-client

GHSA-28f5-38xr-jh2w

Privilege Escalation Java

8.2

CVSS 3.1 · Vendor: https://github.com/appium/java-client

View

Vulnerability Assessment

Weakness

CWE

CWE-441

OWASP Top 10:2025

A01:2025 - Broken Access Control

ASVS 5.0

V4 - API and Web Service Proxy/intermediary controls

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 28, 2026

Silent traffic redirection in Appium Java Client 8.2.1 to 10.1.0 allows an unauthenticated rogue Appium server to redirect all session commands to an attacker-controlled endpoint when directConnect is enabled. The client does not validate the destination host, enabling network pivoting and credential theft. Publicly available exploit code exists, and a vendor-released patch (version 10.1.1) is available.

Affected VersionsENISA

java-client 8.2.1, < 10.1.1

Affected Packages

maven io.appium:java-client fix: 10.1.1

euvd java_client_8_2_1 fix: 10.1.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Java gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/appium/java-client) PRIMARY 8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Primary rating from Vendor (https://github.com/appium/java-client) · only source for this CVE.

CVSS VectorVendor: https://github.com/appium/java-client

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

DescriptionCVE.org

Summary

When directConnect(true) is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEW_SESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint - with no allowlist, no host validation, and no user notification.

Affected Code

AppiumCommandExecutor.java (line 196-219): setDirectConnect() builds

a new URL from server-supplied fields and calls overrideServerUrl(newUrl) without validating host/IP.

DirectConnect.java: getUrl() constructs protocol://host:port/path

with no allowlist.

Root Cause

Only the protocol is validated (must equal "https"). The destination host and port are never checked against any allowlist or denylist.

PoC (confirmed)

A rogue server injecting directConnectHost=127.0.0.1:4443 causes the client to silently redirect all post-session commands:

[bootstrap] POST /wd/hub/session [bootstrap] Injecting directConnect -> https://127.0.0.1:4443/wd/hub [redirect-target] HIT #1: GET /wd/hub/session/poc-session-001/source [redirect-target] HIT #2: DELETE /wd/hub/session/poc-session-001

Original source code unmodified - confirmed via git diff HEAD (empty).

Evidence Screenshots

Screenshot 1 - Rogue server capturing redirected traffic:

Screenshot 2 - Java client processing response from attacker host:

Impact

Full interception of session traffic
Network pivot to internal hosts (RFC-1918, 169.254.169.254)
Cloud credential theft via IMDS endpoint
Escalates to ~8.1 High in CI/CD environments where directConnect(true)

is set in shared base configuration

Suggested Fix

Add allowlist validation before overrideServerUrl() is called, and/or block RFC-1918/loopback/link-local destinations by default.

poc_appium_directconnect.zip

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

66 maven packages depend on io.appium:java-client (2 direct, 64 indirect)

Ecosystem-wide dependent count for version 8.2.1.

Threat Intelligence Overview

EPSS Score

0.2%

Top 85% exploitable

Threat Intel

1 source

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +41

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.