CVE-2026-41491 - Vulnerability Analysis

Overview

Dapr 1.3.0 to <1.15.14, 1.16.0-rc.1 to <1.16.14, and 1.17.0-rc.1 to <1.17.5 contain an access control bypass caused by inconsistent normalization of method paths using reserved URL characters and path traversal sequences, letting attackers bypass service invocation ACLs, exploit requires crafted method paths.

Severity & Score

Impact

Attackers can bypass access control policies, potentially invoking unauthorized services and accessing restricted functionality.

Mitigation

Update to versions 1.15.14, 1.16.14, or 1.17.5 or later.

References

• https://github.com/dapr/dapr/pull/9589
• https://github.com/dapr/dapr/security/advisories/GHSA-85gx-3qv6-4463

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner