high7.1
CVE-2025-47424
Retool (self-hosted) before 3.196.0 allows Host header injection.
Impact
Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Retool | Retool (Self-Hosted) | before 3.196.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.