CVE-2026-41491highCWE-22CWE-284

CVE-2026-41491: fallo de gravedad alta en dapr

Dapr: Service Invocation path traversal ACL bypass

Publicada el

Seguir esta CVE+ Monitorear dapr+ Monitorear github.com/dapr/dapr

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.3%
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path while the target application received a different one. This issue has been patched in versions 1.15.14, 1.16.14, and 1.17.5.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
dapr · dapr
CVEs relacionadas — dapr

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-37918MEDIUMAPI token authentication bypass in HTTP endpoints in DaprEPSS 1.4%CVE-2024-35223MEDIUMDapr API Token ExposureEPSS 0.4%CVE-2026-59096HIGHDapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-HostEPSS 0.3%