Read the docs

dapr

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

dapr records in CISA KEV

No dapr vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2024-23293 CVE-2024-35223 · GHSA-284c-x8m7-9w5h

Dapr API Token Exposure

Priority MEDIUM 63

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00438 Published 2024-05-23 Fixed in 1.13.3 CWE-200
TI-2026-42276 CVE-2026-59096 · GHSA-q8cr-74p8-486p

Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host

Priority MEDIUM 42

Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation wh…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00337 Published 2026-07-02 No fix listed CWE-346
Open these records in search →