CVE-2026-105762: Dify LLM Platform SSRF Vulnerability

CVE-2026-105762 Overview

CVE-2026-105762 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Dify, an open-source Large Language Model (LLM) application development platform. The /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepts an attacker-controlled URL without requiring authentication. A remote attacker can coerce the Dify server into issuing HTTP requests to arbitrary destinations, including internal services and cloud metadata endpoints. This exposes sensitive data and enables use of the Dify host as a network pivot. The issue is fixed in Dify version 1.13.0.

Critical Impact
Unauthenticated attackers can abuse the Dify server to query internal network services and cloud instance metadata, exposing credentials and enabling lateral movement.

Affected Products

Dify (langgenius/dify)
All versions prior to 1.13.0
Deployments exposing the /console/api/remote-files/upload endpoint

Discovery Timeline

2026-10-06 - CVE-2026-105762 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105762

Vulnerability Analysis

The vulnerability resides in the remote_files.py controller, which exposes /console/api/remote-files/upload. The endpoint accepts a URL parameter supplied by the HTTP client and instructs the Dify backend to fetch the referenced resource. The handler does not enforce authentication and does not validate the destination of the request against an allowlist or deny internal address ranges.

Because the server performs the outbound fetch on behalf of the caller, the attacker gains the network identity and routing position of the Dify host. In containerized or cloud deployments, that position typically has access to the orchestration network, sidecar services, and the cloud provider's instance metadata service.

Root Cause

The root cause is missing authentication combined with absent URL validation on a server-side fetch primitive. The controller treats the user-supplied URL as trusted input and issues a request without filtering schemes, hostnames, or IP ranges. There is no mediation layer to block link-local addresses such as 169.254.169.254, private RFC1918 ranges, or loopback addresses.

Attack Vector

An unauthenticated remote attacker sends a crafted POST request to /console/api/remote-files/upload containing a URL that points at an internal target. Typical targets include AWS, Azure, or GCP metadata endpoints to retrieve temporary cloud credentials, Redis or database admin interfaces exposed only on internal networks, and the Kubernetes API server. The attacker reads the server response or uses blind SSRF side effects to enumerate reachable hosts and ports. Successful exploitation chains into credential theft, data exfiltration, and pivoting deeper into the deployment network.

For technical details, see the GitHub Security Advisory GHSA-8235-vv5j-mmvg and the remediation pull request #32236.

Detection Methods for CVE-2026-105762

Indicators of Compromise

Access log entries for POST /console/api/remote-files/upload originating from unauthenticated or unexpected source IPs.
Outbound HTTP connections from the Dify server to 169.254.169.254, loopback addresses, or RFC1918 ranges that do not match normal application behavior.
Unusual DNS lookups from the Dify host for internal hostnames, cloud metadata domains, or attacker-controlled callback domains.
Spikes in request volume to the remote-files/upload endpoint from a single source.

Detection Strategies

Inspect web server and reverse proxy logs for requests to /console/api/remote-files/upload where the request body contains URLs with internal, loopback, or metadata-service hostnames.
Correlate inbound requests to the upload endpoint with outbound network connections from the Dify process to non-public destinations.
Deploy egress monitoring on the Dify host to flag any connection to cloud metadata IPs when the application does not legitimately require it.

Monitoring Recommendations

Enable verbose HTTP access logging on the Dify API tier and forward logs to a central SIEM for correlation.
Alert on any process on the Dify host initiating a TCP session to 169.254.169.254:80 or fd00:ec2::254.
Baseline normal outbound destinations for the Dify workload and alert on deviations.

How to Mitigate CVE-2026-105762

Immediate Actions Required

Upgrade Dify to version 1.13.0 or later, which contains the fix for the vulnerable endpoint.
Restrict network exposure of the Dify console API to trusted administrative networks until the upgrade is complete.
Rotate any cloud instance credentials, API keys, and tokens that could have been reachable from the Dify host.
Audit access logs for prior requests to /console/api/remote-files/upload to identify potential exploitation.

Patch Information

The fix is included in Dify 1.13.0. Review the upstream commit 2f87ecc and the 1.13.0 release notes for upgrade instructions. The patch adds authentication and input validation to the remote files endpoint.

Workarounds

Block or require authentication for /console/api/remote-files/upload at an upstream reverse proxy or web application firewall.
Configure the container or VM running Dify to deny egress to 169.254.169.254 and other sensitive internal ranges using host firewall rules or network policies.
On AWS, require Instance Metadata Service Version 2 (IMDSv2) with a hop limit of 1 to prevent SSRF-based retrieval of instance credentials.
Place the Dify workload behind an authenticated ingress gateway so that unauthenticated requests cannot reach the API.

bash

# Example NGINX snippet to block the vulnerable endpoint pending patching
location = /console/api/remote-files/upload {
    deny all;
    return 403;
}

# Example AWS CLI to enforce IMDSv2 on the Dify EC2 instance
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1