CVE-2026-41491 Details
Description
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path while the target application received a different one. This issue has been patched in versions 1.15.14, 1.16.14, and 1.17.5.
A vulnerability exists in Dapr versions 1.3.0 prior to 1.15.14, 1.16.0-rc.1 prior to 1.16.14, and 1.17.0-rc.1 prior to 1.17.5. This vulnerability allows for bypassing access control policies in service invocation by using reserved URL characters and path traversal sequences in method paths. The issue arises because the access control layer (ACL) normalizes method paths separately from the dispatch layer, leading to a mismatch where the ACL evaluates one path while the target application receives another. For instance, a method path containing encoded traversal sequences could be normalized to an allowed path, while the application would still receive the original denied path.
Users are advised to upgrade to Dapr versions 1.17.5, 1.16.14, or 1.15.14.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dapr/dapr/pull/9589 | [email protected] | Issue TrackingPatch |
| https://github.com/dapr/dapr/security/advisories/GHSA-85gx-3qv6-4463 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation dapr | >= 1.3.0, < 1.15.14 >= 1.16.0, < 1.16.14 >= 1.17.0, < 1.17.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |