CVE-2023-37918mediumCWE-287

CVE-2023-37918: medium-severity vulnerability in dapr

API token authentication bypass in HTTP endpoints in Dapr

Published · Updated

Follow this CVE+ Monitor dapr+ Monitor github.com/dapr/dapr

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 1.4%
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected products
dapr · dapr
Related CVEs — dapr

In the same product, most dangerous first.

CVE-2024-35223MEDIUMDapr API Token ExposureEPSS 0.4%CVE-2026-59096HIGHDapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-HostEPSS 0.3%CVE-2026-41491HIGHDapr: Service Invocation path traversal ACL bypassEPSS 0.3%