Is CVE-2026-58141 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58141 being exploited in the wild.

How severe is CVE-2026-58141?

High severity, with a CVSS score of 7.6, published 6 November 2026.

How is CVE-2026-58141 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-58141?

Check whether you run Dify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58141: Dify SSRF bypass in remote file operations

CVE-2026-58141 · Severity: high · CVSS 7.6 · Published 2026-11-06

Dify, an open-source AI application platform, contains a server-side request forgery (SSRF) vulnerability that allows authenticated users to bypass network protections and reach internal services. An attacker with console access can access internal databases, cloud metadata endpoints containing credentials, and other backend systems that should not be directly accessible from the internet, potentially leading to data theft or system compromise.

Technologies: Dify. Vendors: Dify.

Quick answers

Is CVE-2026-58141 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58141 being exploited in the wild.
How severe is CVE-2026-58141?: High severity, with a CVSS score of 7.6, published 6 November 2026.
Which products and versions are affected?: Dify before 1.15.0.
Is there a fix for CVE-2026-58141?: Yes: fixed in 1.15.0. Until then: Restrict console access to trusted users only. For Docker Compose deployments, enable SSRF_PROXY_ALLOW_PRIVATE_IPS or SSRF_PROXY_ALLOW_PRIVATE_DOMAINS configuration options only when deploying in isolated trusted private networks, and consider implementing network segmentation to isolate Dify from sensitive internal services. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58141 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-58141?: Check whether you run Dify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.15.0

Restrict console access to trusted users only. For Docker Compose deployments, enable SSRF_PROXY_ALLOW_PRIVATE_IPS or SSRF_PROXY_ALLOW_PRIVATE_DOMAINS configuration options only when deploying in isolated trusted private networks, and consider implementing network segmentation to isolate Dify from sensitive internal services.

Technical details

The vulnerability exists in Dify's SSRF proxy configuration, which uses Squid with only source-based access control lists (ACLs) but lacks destination deny rules and independent IP validation in the make_request() helper function. Authenticated console users can exploit multiple endpoints—including GET /console/api/remote-files/<url>, POST /console/api/remote-files/upload, HTTP Request workflow nodes, website crawl, and document import from URL—to reach internal components like PostgreSQL databases and, on AWS, IAM metadata endpoints. The HTTP Request node further allows POST, PUT, and DELETE operations against internal services that rely on network isolation for authorization.

Affected products

Dify Dify before 1.15.0

Timeline

2026-11-06: disclosed
2026-06-18: patched: Fix committed to main branch via PR #36332

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.