CVE-2026-41491

High

Published: 08/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Dapr, from versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences. The ACL normalized the method path independently from the dispatch layer, leading to one path being evaluated by the ACL while the target application received a different one.

Risk Assessment

This vulnerability may lead to unauthorized access to services, posing a serious threat to the security of applications and organizational data.

Recommendation

It is recommended to update Dapr to versions 1.15.14, 1.16.14, or 1.17.5 to mitigate this vulnerability.

Other vulnerabilities in Dapr

CVE-2023-37918Medium
A vulnerability has been found in Dapr that allows bypassing API token authentication. An attacker could craft a well-formed HTTP request that is accepted by Dapr, even if the API token is invalid or missing.

Original NVD description (English source)

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path while the target application received a different one. This issue has been patched in versions 1.15.14, 1.16.14, and 1.17.5.