What’s Vulnerable › Vulnerabilities
CVE-2025-47424
- Severity: high (CVSS 7.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-05-09 · updated 2026-06-17
- Weakness: CWE-348
Description
Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated.
Affected products
- Retool: from 3.18.1 through 3.18.23; from 3.20.1 through 3.20.18; from 3.22.1 through 3.22.21; from 3.24.1 through 3.24.22; from 3.26.4 through 3.26.14; from 3.28.3 through 3.28.15
References
Get alerted when CVE-2025-47424 or the next vulnerability affects your stack