CVE-2025-47424

Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated.

Scoring

Severity

HIGH

CVSS base score

7.1

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C

EPSS probability

0.15%

CWE

CWE-348

Published

2025-05-09

Last modified

2026-03-13

Affected products

• Retool Retool
• Retool Retool
• Retool Retool
• Retool Retool
• Retool Retool
• Retool Retool
• Retool Retool
• Retool Retool

Weakness type

• CWE-348

Related vulnerabilities

• CVE-2026-16272 — Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
• CVE-2026-16732 — fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
• CVE-2026-25552 — Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
• CVE-2026-63220 — CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
• CVE-2026-50243 — 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
• CVE-2026-63770 — Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
• CVE-2026-64619 — FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
• CVE-2026-46415 — Caddy Defender trusted proxy client IP bypass

Markdown version · Browse all CVEs