Path Traversal in Dapr
CVE-2026-41491
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path while the target application received a different one. This issue has been patched in versions 1.15.14, 1.16.14, and 1.17.5.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (39.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 39.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
- Dapr — versions >= 1.3.0, < 1.15.14, >= 1.16.0-rc.1, < 1.16.14, >= 1.17.0-rc.1, < 1.17.5
- Linuxfoundation Dapr
Weakness classification (CWE)
References
- github.com/dapr/dapr/security/advisories/GHSA-85gx-3qv6-4463 (Vendor Advisory)
- github.com/dapr/dapr/pull/9589 (Patch, Issue Tracking)
Frequently asked questions
- What is CVE-2026-41491?
- CVE-2026-41491 is a high-severity vulnerability in Dapr, classified under Path Traversal. CVSS score: 8.1/10. Published 2026-05-08.
- How severe is CVE-2026-41491?
- High severity. CVSS v3 base score is 8.1 out of 10.