Dapr CVE-2026-41491: ACL Bypass via Path Traversal
A critical vulnerability, CVE-2026-41491, has been identified in Dapr, a widely used runtime for distributed applications. This flaw, rated 8.1 (High) by the National Vulnerability Database, allows attackers to bypass access control policies for service invocation. The core issue, as detailed by the National Vulnerability Database, lies in Dapr’s handling of reserved URL characters and path traversal sequences within method paths. The ACL (Access Control List) normalizes the method path independently from the dispatch layer, meaning the ACL evaluates one path while the target application receives a different, potentially malicious, one.
This discrepancy creates a significant security gap. An attacker could craft a request that appears legitimate to the ACL but, due to path traversal, targets an unauthorized endpoint on the backend. This effectively circumvents intended security controls, potentially leading to unauthorized data access or arbitrary code execution within the distributed application environment. The vulnerability is present in Dapr versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5.
Patches are available in Dapr versions 1.15.14, 1.16.14, and 1.17.5. Defenders running Dapr in their environments need to prioritize upgrading immediately. This isn’t a theoretical flaw; it’s a clear bypass that attackers will exploit to gain unauthorized access to internal services. Given Dapr’s role in distributed systems, this vulnerability has far-reaching implications for microservice architectures.
What This Means For You
- If your organization uses Dapr, you must immediately audit your Dapr instances for CVE-2026-41491. Prioritize patching to versions 1.15.14, 1.16.14, or 1.17.5. Failure to do so leaves your distributed applications exposed to critical access control bypasses.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Dapr CVE-2026-41491: Path Traversal in Service Invocation
title: Dapr CVE-2026-41491: Path Traversal in Service Invocation
id: scw-2026-05-08-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit Dapr CVE-2026-41491 by using path traversal sequences within the URI of a service invocation request. The vulnerability allows bypassing ACLs by manipulating the method path. This rule specifically looks for common URL-encoded path traversal characters in the URI, which is indicative of an exploit attempt against Dapr's service invocation mechanism.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-41491/
tags:
- attack.lateral_movement
- attack.t1071.001
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/..%252f'
- '/..%255c'
- '/..%2f'
- '/..%5c'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-41491 | Auth Bypass | Dapr versions 1.3.0 to before 1.15.14 |
| CVE-2026-41491 | Auth Bypass | Dapr versions 1.16.0-rc.1 to before 1.16.14 |
| CVE-2026-41491 | Auth Bypass | Dapr versions 1.17.0-rc.1 to before 1.17.5 |
| CVE-2026-41491 | Path Traversal | Service invocation using reserved URL characters and path traversal sequences in method paths |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 08, 2026 at 17:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
CVE-2026-6665 — The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM...