CVE-2025-47424

State: Published
Severity: 7.1 High
Published: May 9, 2025
Updated: May 12, 2025
Reserved: May 7, 2025

Description

Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C	mitre

Weaknesses

CWE-348 Use of Less Trusted Source

Affected Products

Product	Versions
RetoolRetool	3.18.1 through 3.18.23Affected 3.20.1 through 3.20.18Affected 3.22.1 through 3.22.21Affected 3.24.1 through 3.24.22Affected 3.26.4 through 3.26.14Affected 3.28.3 through 3.28.15Affected 3.30.1 through 3.30.15Affected 3.32.1 through 3.32.12Affected 3.33.1-stable through 3.33.37-stableAffected 3.52.1-stable through 3.52.28-stableAffected 3.75.1-stable through 3.75.25-stableAffected 3.114.1-stable through 3.114.22-stableAffected 3.148.1-stable through 3.148.22-stableAffected

Product

Versions

RetoolRetool

3.18.1 through 3.18.23Affected
3.20.1 through 3.20.18Affected
3.22.1 through 3.22.21Affected
3.24.1 through 3.24.22Affected
3.26.4 through 3.26.14Affected
3.28.3 through 3.28.15Affected
3.30.1 through 3.30.15Affected
3.32.1 through 3.32.12Affected
3.33.1-stable through 3.33.37-stableAffected
3.52.1-stable through 3.52.28-stableAffected
3.75.1-stable through 3.75.25-stableAffected
3.114.1-stable through 3.114.22-stableAffected
3.148.1-stable through 3.148.22-stableAffected

References

https://docs.retool.com/disclosures/cve-2025-47424

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.