Vulnerability · Published May 9, 2025 · Assigned by mitre

CVE-2025-47424

High 7.1

In plain English

A high-severity security flaw in Retool from Retool. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated.

Affected products (as reported)

Vendor	Product	Versions
Retool	Retool	3.18.1 – through 3.18.233.20.1 – through 3.20.183.22.1 – through 3.22.213.24.1 – through 3.24.223.26.4 – through 3.26.143.28.3 – through 3.28.153.30.1 – through 3.30.153.32.1 – through 3.32.12

Weakness: CWE-348 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C

References

https://docs.retool.com/disclosures/cve-2025-47424