Read the docs
TI-2026-85982 Aliases CVE-2026-58141GHSA-4fc6-wx4f-48w6

Server-side request forgery in Dify bypasses SSRF protections

Priority LOW 38CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Dify from 0.6.0 before 1.15.0 contains a server-side request forgery flaw (CWE-918) in which any authenticated console user can bypass SSRF protections. The Squid proxy defines only source ACLs without destination deny rules, and the make_request() helper does no independent destination IP validation. An attacker can send arbitrary HTTP requests to internal services and cloud metadata endpoints, and on AWS deployments can read IAM credentials from the instance metadata service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without destination deny rules and the make_request() helper performing no independent destination IP validation. Attackers can use endpoints such as GET /console/api/remote-files/<url>, POST /console/api/remote-files/upload, the HTTP Request workflow node, website crawl, or document import from URL to reach internal components like the sandbox, internal APIs, and PostgreSQL, and on AWS deployments read IAM credentials from the instance metadata service, with the HTTP Request node further enabling POST, PUT, and DELETE writes to internal services relying on network isolation for authorization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix Fixed dify (langgenius): 1.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
langgeniusdify0.6.0 to before 1.15.01.15.0Patch availableCNA
  • dify Vendorlanggenius Affected 0.6.0 to before 1.15.0 Fixed in 1.15.0 Patch available CNA

Remediation

Upgrade langgenius Dify to version 1.15.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA dify (langgenius) Fixed in 1.15.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-58141
  2. 2026-11-06 CISA SSVC decision points changed
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Alias added: GHSA-4fc6-wx4f-48w6

References

Patch 2

Other 1

  • TI-2025-35265 Default credentials in Dify thru 1.5.1. CVSS 3.1CRITICAL 9.8
  • TI-2026-30343 Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints CVSS 4.0CRITICAL 9.3
  • TI-2026-68373 Unauthenticated server-side request forgery in Dify remote file upload CVSS 3.1HIGH 8.3
  • TI-2026-30344 Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access CVSS 4.0CRITICAL 9.3
  • TI-2026-44066 Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text CVSS 4.0HIGH 8.7
  • TI-2025-03045 Unsanitized Input in langgenius/dify CVSS 3.1HIGH 7.2
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences