CVE-2026-41491: Dapr access control bypass via path traversal in service invocation

CVE-2026-41491 · Severity: high · CVSS 8.1 · Published 2026-05-08

Dapr is a distributed application runtime used to connect and manage microservices. A security flaw in its access control system allows attackers to bypass security policies that restrict which services or functions can be called. By using specially crafted characters in a web request, an attacker could gain unauthorized access to sensitive internal application functions, potentially leading to data exposure or unauthorized actions.

Technologies: github.com/dapr/dapr (Go). Vendors: Go.

Quick answers

Is CVE-2026-41491 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41491 being exploited in the wild.
How severe is CVE-2026-41491?
High severity, with a CVSS score of 8.1, published 8 May 2026.
Which products and versions are affected?
github.com/dapr/dapr (Go) SEMVER:introduced=1.17.0-rc.1,fixed=1.17.5, SEMVER:introduced=1.3.0,fixed=1.15.14,introduced=1.16.0-rc.1,fixed=1.16.14,introduced=1.17.0-rc.1,fixed=1.17.5.
Is there a fix for CVE-2026-41491?
Yes. github.com/dapr/dapr (Go): upgrade to 1.17.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41491 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41491?
Check whether you run github.com/dapr/dapr (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/dapr/dapr (Go): upgrade to 1.17.5 or later
    go get github.com/dapr/dapr@v1.17.5

Technical details

A vulnerability in Dapr's service invocation mechanism allows for Access Control List (ACL) bypass via path traversal and reserved character manipulation. The root cause is a normalization discrepancy: the ACL layer normalized method paths (resolving sequences like '../' and stripping fragments/queries) independently from the dispatch layer, which passed the raw method string to the target application. An attacker with network access and low privileges can use encoded sequences (e.g., 'admin%2F..%2Fpublic') or reserved characters (e.g., '%23' for #) to satisfy an allowed ACL rule while the underlying dispatch layer reaches a restricted endpoint. This is particularly impactful for gRPC APIs where method strings are passed raw. The issue is fixed in versions 1.15.14, 1.16.14, and 1.17.5.

Affected products

  • Linux Foundation Dapr 1.3.0 to 1.15.13, 1.16.0 to 1.16.13, 1.17.0 to 1.17.4

Identifiers

  • CVE-2026-41491
  • GHSA-85gx-3qv6-4463
  • GO-2026-5242

Timeline

  • 2026-04-16: advisory: Vendor advisory published on GitHub
  • 2026-05-08: disclosed: CVE published to NVD
  • 2026-05-08: patched: Patch versions 1.15.14, 1.16.14, and 1.17.5 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.