Log in Start free

Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-41491Dapr: Service Invocation path traversal ACL bypass

High 8.1

In plain English

A high-severity path traversal in dapr from dapr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 74.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path while the target application received a different one. This issue has been patched in versions 1.15.14, 1.16.14, and 1.17.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/dapr/dapr1.17.5GHSA-85gx-3qv6-4463
Gogithub.com/dapr/dapr1.16.14GHSA-85gx-3qv6-4463
Gogithub.com/dapr/dapr1.15.14GHSA-85gx-3qv6-4463
Gogithub.com/dapr/dapr1.15.14, 1.16.14, 1.17.5GO-2026-5242

Affected products (as reported)

VendorProductVersions
dapr dapr >= 1.3.0, < 1.15.14>= 1.16.0-rc.1, < 1.16.14>= 1.17.0-rc.1, < 1.17.5

Weakness: CWE-22, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References