Executive brief
Dapr is a distributed application runtime used to connect and manage microservices. A security flaw in its access control system allows attackers to bypass security policies that restrict which services or functions can be called. By using specially crafted characters in a web request, an attacker could gain unauthorized access to sensitive internal application functions, potentially leading to data exposure or unauthorized actions.
Technical details
A vulnerability in Dapr's service invocation mechanism allows for Access Control List (ACL) bypass via path traversal and reserved character manipulation. The root cause is a normalization discrepancy: the ACL layer normalized method paths (resolving sequences like '../' and stripping fragments/queries) independently from the dispatch layer, which passed the raw method string to the target application. An attacker with network access and low privileges can use encoded sequences (e.g., 'admin%2F..%2Fpublic') or reserved characters (e.g., '%23' for #) to satisfy an allowed ACL rule while the underlying dispatch layer reaches a restricted endpoint. This is particularly impactful for gRPC APIs where method strings are passed raw. The issue is fixed in versions 1.15.14, 1.16.14, and 1.17.5.
Affected products
- Linux Foundation Dapr 1.3.0 to 1.15.13, 1.16.0 to 1.16.13, 1.17.0 to 1.17.4
Timeline
- 2026-04-16: advisory: Vendor advisory published on GitHub
- 2026-05-08: disclosed: CVE published to NVD
- 2026-05-08: patched: Patch versions 1.15.14, 1.16.14, and 1.17.5 released