{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/network-pivot/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["java-client (\u003e= 8.2.1, \u003c= 10.1.0)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","vulnerability","network-pivot","credential-theft","java","CI/CD"],"_cs_type":"advisory","_cs_vendors":["Appium"],"content_html":"\u003cp\u003eA high-severity vulnerability (CVE-2026-43910) has been identified in \u003ccode\u003eappium/java-client\u003c/code\u003e versions 8.2.1 through 10.1.0. When the \u003ccode\u003edirectConnect(true)\u003c/code\u003e option is enabled, the \u003ccode\u003eAppiumCommandExecutor\u003c/code\u003e component of the client unconditionally accepts and trusts \u003ccode\u003edirectConnectHost\u003c/code\u003e, \u003ccode\u003edirectConnectPort\u003c/code\u003e, and \u003ccode\u003edirectConnectPath\u003c/code\u003e parameters supplied by an Appium server in its \u003ccode\u003eNEW_SESSION\u003c/code\u003e response. This lack of validation allows a malicious or compromised Appium server to force the \u003ccode\u003ejava-client\u003c/code\u003e to silently redirect all subsequent session traffic to an attacker-specified internal host, including loopback addresses (127.0.0.1), RFC-1918 private IP ranges, or link-local addresses (169.254.169.254) such as AWS EC2 Instance Metadata Service (IMDS) endpoints. This flaw enables attackers to intercept session data, pivot within internal networks, and potentially steal cloud credentials, posing a significant risk, particularly in CI/CD environments where automated tests frequently use \u003ccode\u003edirectConnect(true)\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker controls or compromises an Appium server that a vulnerable \u003ccode\u003ejava-client\u003c/code\u003e application is configured to connect to.\u003c/li\u003e\n\u003cli\u003eDuring the \u003ccode\u003eNEW_SESSION\u003c/code\u003e response phase, the attacker-controlled server injects malicious \u003ccode\u003edirectConnectHost\u003c/code\u003e, \u003ccode\u003edirectConnectPort\u003c/code\u003e, and \u003ccode\u003edirectConnectPath\u003c/code\u003e parameters. These parameters point to an internal IP address, such as \u003ccode\u003e169.254.169.254\u003c/code\u003e (for IMDS), \u003ccode\u003e127.0.0.1\u003c/code\u003e (for local services), or other RFC-1918 addresses within the target network.\u003c/li\u003e\n\u003cli\u003eA legitimate \u003ccode\u003ejava-client\u003c/code\u003e application, with \u003ccode\u003edirectConnect(true)\u003c/code\u003e enabled, initiates a session and connects to the attacker-controlled Appium server.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003eAppiumCommandExecutor\u003c/code\u003e component within the \u003ccode\u003ejava-client\u003c/code\u003e receives and unconditionally accepts the malicious \u003ccode\u003edirectConnect\u003c/code\u003e parameters from the server.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ejava-client\u003c/code\u003e then silently reconfigures its connection, redirecting all subsequent WebDriver commands and session traffic from the original Appium server to the attacker-specified internal endpoint, without performing any host validation or notifying the user.\u003c/li\u003e\n\u003cli\u003eThe attacker intercepts this redirected session traffic, which may contain sensitive WebDriver commands or responses. They can then leverage the client's internal network access to initiate further requests against internal services (e.g., IMDS endpoints) from the context of the vulnerable client, enabling data exfiltration or cloud credential theft.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-43910 allows for significant impact, particularly in automated testing and CI/CD pipelines. Attackers can achieve full interception of sensitive session traffic, potentially exfiltrating data or command responses. More critically, the vulnerability enables a network pivot, allowing the client to be weaponized to access internal hosts, including private network ranges (RFC-1918) and link-local addresses such as the AWS IMDS endpoint (169.254.169.254). This access can lead to the theft of cloud credentials, escalating the attack to compromise cloud infrastructure. The vulnerability is considered high severity, rated approximately 8.1, especially within CI/CD environments where \u003ccode\u003edirectConnect(true)\u003c/code\u003e is often configured in shared base settings, making large numbers of client applications vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize patching \u003ccode\u003eio.appium:java-client\u003c/code\u003e to a version greater than 10.1.0 to address CVE-2026-43910.\u003c/li\u003e\n\u003cli\u003eReview and update \u003ccode\u003eio.appium:java-client\u003c/code\u003e dependencies to ensure they are not within the vulnerable range (\u003ccode\u003e\u0026gt;= 8.2.1, \u0026lt;= 10.1.0\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, avoid using \u003ccode\u003edirectConnect(true)\u003c/code\u003e with untrusted Appium servers.\u003c/li\u003e\n\u003cli\u003eMonitor network connections originating from systems running \u003ccode\u003ejava-client\u003c/code\u003e for suspicious outbound connections to RFC-1918 IP addresses or the \u003ccode\u003e169.254.169.254\u003c/code\u003e IMDS endpoint, which could indicate exploitation of this or similar vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T14:28:27Z","date_published":"2026-07-28T14:28:27Z","id":"https://feed.craftedsignal.io/briefs/2026-07-appium-java-client-pivot-vulnerability/","summary":"A vulnerability, CVE-2026-43910, in Appium's java-client allows a malicious Appium server to redirect all subsequent session traffic to an arbitrary internal endpoint by injecting unvalidated `directConnectHost` and `directConnectPort` parameters when `directConnect(true)` is enabled, potentially leading to session traffic interception, network pivoting, and cloud credential theft.","title":"Appium Java Client Allows Network Pivot via Unvalidated directConnect Redirect (CVE-2026-43910)","url":"https://feed.craftedsignal.io/briefs/2026-07-appium-java-client-pivot-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Network-Pivot","version":"https://jsonfeed.org/version/1.1"}