CVE-2026-105761: Dify LLM Platform Auth Bypass Vulnerability

CVE-2026-105761 Overview

CVE-2026-105761 is an Insecure Direct Object Reference (IDOR) vulnerability in Dify, an open-source Large Language Model (LLM) application development platform. The flaw exists in the PUT /console/api/apps/<app_id>/server endpoint handled by AppMCPServerController.put() in api/controllers/console/app/mcp_server.py. The controller retrieves an AppMCPServer using the client-supplied server ID without verifying that the server belongs to the requested application and tenant. An authenticated workspace member can modify another application's Model Context Protocol (MCP) server status and parameters. The issue is fixed in Dify version 1.16.0 and is tracked under [CWE-639].

Critical Impact
An authenticated workspace user can tamper with MCP server configurations across applications, potentially redirecting LLM data flows or disabling services.

Affected Products

Dify (langgenius/dify) versions prior to 1.16.0
Deployments exposing the Dify console API to authenticated workspace members
Multi-tenant Dify installations serving multiple applications

Discovery Timeline

2026-10-05 - CVE-2026-105761 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105761

Vulnerability Analysis

The vulnerability resides in Dify's console API controller for MCP servers. The PUT /console/api/apps/<app_id>/server endpoint accepts an application identifier in the URL path and a server identifier in the request body. The controller looks up the AppMCPServer record using only the client-supplied server ID. The code does not cross-check that the resolved server belongs to the application referenced in <app_id> or to the tenant executing the request.

An authenticated workspace member can therefore submit a server ID belonging to another application and modify its MCP server attributes. Changes include enabling or disabling the server and altering endpoint parameters, which can redirect data generated by LLM workflows to attacker-chosen destinations.

Root Cause

The root cause is missing authorization scoping on nested resource lookups [CWE-639]. The controller trusts the primary key provided by the caller rather than enforcing an ownership predicate joining AppMCPServer, App, and tenant. The upstream fix in pull request #38177 introduces an AppRefService and uses SQLAlchemy select statements that scope lookups by owner references, raising NotFound when ownership does not match.

Attack Vector

The attack requires network access to the console API and valid workspace credentials. No user interaction is required. The attacker enumerates or guesses MCP server IDs belonging to other applications within the same Dify instance and sends a crafted PUT request to modify them.

python

# Patch excerpt - fix(api): scope nested resource lookups by owner refs (#38177)
# api/controllers/console/app/audio.py
 from core.errors.error import ModelCurrentlyNotSupportError, ProviderTokenNotInitError, QuotaExceededError
 from extensions.ext_database import db
 from graphon.model_runtime.errors.invoke import InvokeError
-from libs.login import login_required
+from libs.login import current_user, login_required
 from models import App, AppMode
+from services.app_ref_service import AppRefService
 from services.audio_service import AudioService

Source: GitHub Commit 62cb5b5

Detection Methods for CVE-2026-105761

Indicators of Compromise

Unexpected PUT requests to /console/api/apps/<app_id>/server where the server body ID does not correspond to resources previously created under <app_id>
MCP server configuration changes (endpoint URL, status toggles) that do not correlate with legitimate administrator activity
Workspace member accounts issuing cross-application API calls outside their normal application scope

Detection Strategies

Correlate Dify console API audit logs with application ownership records to identify cross-tenant or cross-application resource modifications
Alert on MCP server endpoint changes that redirect traffic to unknown external hosts or newly registered domains
Baseline per-user API call patterns and flag workspace members accessing apps/<app_id>/server paths for applications they do not own

Monitoring Recommendations

Enable verbose request logging on the Dify console API and ship logs to a centralized data lake for retention and search
Monitor outbound traffic from MCP integrations for new or unexpected destinations following configuration changes
Track Dify version strings in deployment inventories to confirm all instances run 1.16.0 or later

How to Mitigate CVE-2026-105761

Immediate Actions Required

Upgrade all Dify deployments to version 1.16.0 or later, which includes the fix from pull request #38177
Audit existing MCP server configurations for unauthorized modifications, with particular attention to endpoint URLs and enabled status
Rotate any credentials, API keys, or tokens that may have been exposed to a redirected MCP server

Patch Information

The fix is included in Dify 1.16.0. The remediation introduces owner-scoped lookups through a new AppRefService and enforces that nested resources (including AppMCPServer) are retrieved via SQLAlchemy queries filtered by application and tenant ownership. See the GitHub Release 1.16.0, Pull Request #38177, and Security Advisory GHSA-ccrj-frp2-c945 for details.

Workarounds

Restrict access to the Dify console API using network-level controls so only trusted administrators can reach /console/api/apps/*/server endpoints
Reduce the number of workspace members with authenticated console access until the upgrade is complete
Place a reverse proxy or web application firewall in front of the Dify console to inspect and filter PUT requests targeting MCP server endpoints

bash

# Verify installed Dify version and upgrade
docker inspect langgenius/dify-api --format '{{.Config.Image}}'
docker pull langgenius/dify-api:1.16.0
docker compose -f docker-compose.yaml up -d