CVE-2026-41491highCWE-22CWE-284

CVE-2026-41491: high-severity vulnerability in dapr

Dapr: Service Invocation path traversal ACL bypass

Published

Follow this CVE+ Monitor dapr+ Monitor github.com/dapr/dapr

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.3%
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path while the target application received a different one. This issue has been patched in versions 1.15.14, 1.16.14, and 1.17.5.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
dapr · dapr
Related CVEs — dapr

In the same product, most dangerous first.

CVE-2023-37918MEDIUMAPI token authentication bypass in HTTP endpoints in DaprEPSS 1.4%CVE-2024-35223MEDIUMDapr API Token ExposureEPSS 0.4%CVE-2026-59096HIGHDapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-HostEPSS 0.3%