CVE-2025-47424 — Retool / Retool

Description (CNA)

Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated.

Affected (CNA)

Vendor / product	Versions
Retool / Retool	affected 3.18.1 through 3.18.23; affected 3.20.1 through 3.20.18; affected 3.22.1 through 3.22.21; affected 3.24.1 through 3.24.22; affected 3.26.4 through 3.26.14; affected 3.28.3 through 3.28.15; affected 3.30.1 through 3.30.15; affected 3.32.1 through 3.32.12; affected 3.33.1-stable through 3.33.37-stable; affected 3.52.1-stable through 3.52.28-stable; affected 3.75.1-stable through 3.75.25-stable; affected 3.114.1-stable through 3.114.22-stable; affected 3.148.1-stable through 3.148.22-stable

Vendor / product

Versions

Retool / Retool

affected 3.18.1 through 3.18.23; affected 3.20.1 through 3.20.18; affected 3.22.1 through 3.22.21; affected 3.24.1 through 3.24.22; affected 3.26.4 through 3.26.14; affected 3.28.3 through 3.28.15; affected 3.30.1 through 3.30.15; affected 3.32.1 through 3.32.12; affected 3.33.1-stable through 3.33.37-stable; affected 3.52.1-stable through 3.52.28-stable; affected 3.75.1-stable through 3.75.25-stable; affected 3.114.1-stable through 3.114.22-stable; affected 3.148.1-stable through 3.148.22-stable

CWE

CWE-348

References

https://docs.retool.com/disclosures/cve-2025-47424

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.