CVE-2026-41491: Dapr Path Traversal Vulnerability

CVE-2026-41491 Overview

CVE-2026-41491 is an access control bypass vulnerability in Dapr, a portable event-driven runtime for building distributed applications across cloud and edge environments. The flaw allows authenticated attackers to bypass service invocation access control policies by leveraging reserved URL characters and path traversal sequences in method paths. The Dapr access control list (ACL) normalizes the method path independently from the dispatch layer, creating a parsing mismatch. The ACL evaluates one path while the target application receives a different one, enabling unauthorized invocation of restricted methods. The vulnerability affects Dapr versions 1.3.0 through 1.15.13, 1.16.0-rc.1 through 1.16.13, and 1.17.0-rc.1 through 1.17.4.

Critical Impact
Attackers with low-privileged network access can bypass service invocation ACLs to reach restricted methods, compromising confidentiality and integrity of distributed application workloads.

Affected Products

Dapr versions 1.3.0 to before 1.15.14
Dapr versions 1.16.0-rc.1 to before 1.16.14
Dapr versions 1.17.0-rc.1 to before 1.17.5

Discovery Timeline

2026-05-08 - CVE-2026-41491 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-41491

Vulnerability Analysis

The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). Dapr's service invocation feature enforces access control through ACL policies that match HTTP method paths against allow/deny rules. The vulnerability stems from inconsistent path normalization between two components in the request pipeline. The ACL evaluation logic normalizes the incoming method path one way, while the dispatch layer that forwards the request to the target application normalizes it differently.

This parser differential allows an attacker to craft a request that the ACL interprets as targeting an allowed endpoint, but which the dispatch layer routes to a restricted endpoint. Reserved URL characters and path traversal sequences such as .., encoded slashes, and similar artifacts trigger the divergence. The result is an authorization decision made on a different resource than the one actually invoked.

Root Cause

The root cause is duplicated and inconsistent path normalization logic across the Dapr runtime. Two independent code paths process the same input differently, producing two distinct canonical representations of the request path. Security decisions made on the ACL's representation do not bind to the resource the dispatcher ultimately reaches.

Attack Vector

An attacker with valid low-privileged credentials to invoke at least one Dapr service can craft service invocation requests containing reserved characters or .. sequences in the method path. The malicious request passes ACL checks designed to permit access only to specific methods, but the dispatch layer resolves the path to a different, restricted method on the target application. Exploitation requires network access to the Dapr sidecar or control plane API.

No verified public exploit code is currently available. Technical details are described in the Dapr GitHub Security Advisory GHSA-85gx-3qv6-4463 and the corresponding remediation pull request #9589.

Detection Methods for CVE-2026-41491

Indicators of Compromise

Service invocation requests containing path traversal sequences such as .., %2e%2e, or %2f in the method path field.
Unexpected access to restricted Dapr application methods from identities not authorized for those endpoints in ACL policy.
Discrepancies between Dapr sidecar access logs and target application access logs for the same request ID.

Detection Strategies

Inspect Dapr sidecar HTTP and gRPC logs for method paths containing percent-encoded characters, double slashes, or .. segments.
Correlate ACL allow decisions in Dapr control plane logs against the actual method invoked on the target application to surface path-mismatch events.
Deploy signatures in network monitoring tools to flag service invocation traffic carrying reserved URL characters in /v1.0/invoke/<app-id>/method/ paths.

Monitoring Recommendations

Centralize Dapr sidecar, control plane, and application logs into a SIEM and alert on anomalous method paths or ACL denial spikes.
Establish baselines for service-to-service invocation patterns and alert on first-time access between caller-callee pairs.
Monitor for the Dapr runtime version reported by sidecars to identify unpatched workloads across the cluster.

How to Mitigate CVE-2026-41491

Immediate Actions Required

Upgrade Dapr to version 1.15.14, 1.16.14, or 1.17.5 depending on your current release branch.
Audit existing service invocation ACL policies and verify that no critical authorization decisions depend solely on method-path string matching.
Inventory all Dapr sidecars and control plane components across Kubernetes namespaces and self-hosted deployments to confirm patched versions are deployed.

Patch Information

The Dapr maintainers released fixes in versions 1.15.14, 1.16.14, and 1.17.5. The remediation unifies path normalization between the ACL evaluator and the dispatch layer so both components operate on the same canonical path. Patch details are available in Dapr Pull Request #9589 and the GitHub Security Advisory GHSA-85gx-3qv6-4463.

Workarounds

Restrict network access to Dapr sidecars and the service invocation API using Kubernetes NetworkPolicies or service mesh authorization rules.
Enforce mutual TLS (mTLS) between Dapr components and require strong caller identity verification at the application layer in addition to ACL enforcement.
Implement defense-in-depth authorization checks inside target applications rather than relying solely on Dapr ACL policies for sensitive methods.

bash

# Upgrade Dapr control plane via Helm to a patched release
helm repo update
helm upgrade --install dapr dapr/dapr \
  --version 1.17.5 \
  --namespace dapr-system \
  --create-namespace

# Verify runtime version on all sidecars
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{"\t"}{.spec.containers[?(@.name=="daprd")].image}{"\n"}{end}'