CVE-2026-41491
Description
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path while the target application received a different one. This issue has been patched in versions 1.15.14, 1.16.14, and 1.17.5.
How to fix
- linuxfoundation dapr1.15.14, 1.16.14, 1.17.5 or later
- github.com/dapr/dapr1.17.5, 1.16.14, 1.15.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation dapr | 1.3.0 ≤ v < 1.15.14, 1.16.0 ≤ v < 1.16.14, 1.17.0 ≤ v < 1.17.5 | 1.15.14, 1.16.14, 1.17.5 |
| github.com/dapr/daprGo | 1.17.0-rc.1 ≤ v < 1.17.5, 1.16.0-rc.1 ≤ v < 1.16.14, 1.3.0 ≤ v < 1.15.14 | 1.17.5, 1.16.14, 1.15.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.