{"id":"CVE-2026-58141","kind":"vulnerability","aliases":["CVE-2026-58141"],"related":[],"title":"Dify: any console user can reach internal services and cloud metadata","description":"Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without destination deny rules and the make_request() helper performing no independent destination IP validation. Attackers can use endpoints such as GET /console/api/remote-files/<url>, POST /console/api/remote-files/upload, the HTTP Request workflow node, website crawl, or document import from URL to reach internal components like the sandbox, internal APIs, and PostgreSQL, and on AWS deployments read IAM credentials from the instance metadata service, with the HTTP Request node further enabling POST, PUT, and DELETE writes to internal services relying on network isolation for authorization.","summary":"Dify before 1.15.0 lets any logged-in console user send arbitrary HTTP requests from the server through remote file, upload, and HTTP Request workflow endpoints, bypassing its SSRF protections. An attacker can reach internal services, PostgreSQL, the sandbox, and on AWS read IAM credentials from the instance metadata service.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","dify","postgresql","self-hosted"],"not_affected_if":["managed-hosting","no-console-users-beyond-trusted","version-1.15.0-or-later"],"how_to_check":"- Check the Dify version in use; affected if below `1.15.0`\n- Review whether the console is reachable by users who are not fully trusted\n- On AWS, check whether instances allow IMDS access from the Dify containers","fix":"- Dify: upgrade to `1.15.0` or later","status":"open","published_at":"2026-11-06T16:18:54+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","triaged_at":"2026-11-06T16:44:40+00:00","updated_at":"2026-11-06T16:44:40+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-06T16:44:40Z","model":"claude-haiku-5-5","output":{"fix":"- Dify: upgrade to `1.15.0` or later","reach":"network","title":"Dify: any console user can reach internal services and cloud metadata","impact":"high","summary":"Dify before 1.15.0 lets any logged-in console user send arbitrary HTTP requests from the server through remote file, upload, and HTTP Request workflow endpoints, bypassing its SSRF protections. An attacker can reach internal services, PostgreSQL, the sandbox, and on AWS read IAM credentials from the instance metadata service.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["dify","self-hosted","aws","postgresql"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads cloud IAM credentials and reaches internal databases and services","analyst_note":"Confirm the exact affected deployment scope and whether managed Dify is affected; check the release notes for 1.15.0 at the linked GitHub release page.","how_to_check":"- Check the Dify version in use; affected if below `1.15.0`\n- Review whether the console is reachable by users who are not fully trusted\n- On AWS, check whether instances allow IMDS access from the Dify containers","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","version-1.15.0-or-later","no-console-users-beyond-trusted"],"who_is_affected":"Self-hosted Dify deployments before 1.15.0 where a console account is held by anyone beyond trusted staff. The flaw comes from the Squid proxy lacking destination deny rules and from the request helper not validating destination IPs, so any deployment relying on network isolation for internal services is exposed. Managed hosting handled by the vendor is not described by the sources as affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":4455,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-58141':14A,17A '/console/api/remote-files':142C '/console/api/remote-files/upload':144C '1.15.0':29B,79C 'acl':119C 'ai':19B 'ai-tool':18B 'allow':89C 'api':165C 'arbitrari':38B,100C 'attack':58B,135C 'authent':91C 'author':200C 'aw':21B,68B,170C 'bypass':53B,95C 'cloud':10A,107C 'compon':160C 'configur':115C 'consol':3A,35B,92C 'contain':80C 'crawl':151C 'credenti':71B,174C 'cve':12A,15A 'defin':117C 'delet':190C 'deni':122C 'deploy':171C 'destin':121C,132C 'difi':1A,22B,27B,77C 'document':153C 'due':110C 'enabl':186C 'endpoint':52B,109C,138C 'file':46B 'forgeri':86C 'get':141C 'helper':128C 'host':26B 'http':39B,49B,101C,146C,182C 'iam':70B,173C 'import':154C 'independ':131C 'instanc':74B,177C 'intern':7A,61B,104C,159C,164C,193C 'ip':133C 'isol':198C 'issu':99C 'let':30B 'like':161C 'log':33B 'logged-in':32B 'make':126C 'metadata':11A,75B,108C,178C 'network':197C 'node':149C,184C 'perform':129C 'post':143C,187C 'postgresql':23B,63B,167C 'protect':56B,97C 'proxi':114C 'put':188C 'reach':6A,60B,158C 'read':69B,172C 'reli':195C 'remot':45B 'request':40B,50B,85C,102C,127C,147C,183C 'rule':123C 'sandbox':65B,163C 'self':25B 'self-host':24B 'send':37B 'server':43B,83C 'server-sid':82C 'servic':8A,62B,76B,105C,179C,194C 'side':84C 'sourc':118C 'squid':113C 'ssrf':55B,96C 'tool':20B 'upload':47B 'url':156C 'use':137C 'user':4A,36B,93C 'valid':134C 'vulner':87C 'websit':150C 'without':120C 'workflow':51B,148C 'write':191C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Dify deployments before 1.15.0 where a console account is held by anyone beyond trusted staff. The flaw comes from the Squid proxy lacking destination deny rules and from the request helper not validating destination IPs, so any deployment relying on network isolation for internal services is exposed. Managed hosting handled by the vendor is not described by the sources as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","aws","dify","high","postgresql","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-58141':14A,17A 'cloud':10A 'consol':3A 'cve':12A,15A 'difi':1A 'intern':7A 'metadata':11A 'reach':6A 'servic':8A 'user':4A","search_b":"'1.15.0':29B 'ai':19B 'ai-tool':18B 'arbitrari':38B 'attack':58B 'aw':21B,68B 'bypass':53B 'consol':35B 'credenti':71B 'difi':22B,27B 'endpoint':52B 'file':46B 'host':26B 'http':39B,49B 'iam':70B 'instanc':74B 'intern':61B 'let':30B 'log':33B 'logged-in':32B 'metadata':75B 'postgresql':23B,63B 'protect':56B 'reach':60B 'read':69B 'remot':45B 'request':40B,50B 'sandbox':65B 'self':25B 'self-host':24B 'send':37B 'server':43B 'servic':62B,76B 'ssrf':55B 'tool':20B 'upload':47B 'user':36B 'workflow':51B","search_c":"'/console/api/remote-files':142C '/console/api/remote-files/upload':144C '1.15.0':79C 'acl':119C 'allow':89C 'api':165C 'arbitrari':100C 'attack':135C 'authent':91C 'author':200C 'aw':170C 'bypass':95C 'cloud':107C 'compon':160C 'configur':115C 'consol':92C 'contain':80C 'crawl':151C 'credenti':174C 'defin':117C 'delet':190C 'deni':122C 'deploy':171C 'destin':121C,132C 'difi':77C 'document':153C 'due':110C 'enabl':186C 'endpoint':109C,138C 'forgeri':86C 'get':141C 'helper':128C 'http':101C,146C,182C 'iam':173C 'import':154C 'independ':131C 'instanc':177C 'intern':104C,159C,164C,193C 'ip':133C 'isol':198C 'issu':99C 'like':161C 'make':126C 'metadata':108C,178C 'network':197C 'node':149C,184C 'perform':129C 'post':143C,187C 'postgresql':167C 'protect':97C 'proxi':114C 'put':188C 'reach':158C 'read':172C 'reli':195C 'request':85C,102C,127C,147C,183C 'rule':123C 'sandbox':163C 'server':83C 'server-sid':82C 'servic':105C,179C,194C 'side':84C 'sourc':118C 'squid':113C 'ssrf':96C 'url':156C 'use':137C 'user':93C 'valid':134C 'vulner':87C 'websit':150C 'without':120C 'workflow':148C 'write':191C","first_public_at":"2026-11-06T16:18:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58141","severity":null,"published_at":"2026-11-06T16:18:54+00:00","modified_at":"2026-11-06T16:18:54+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","fetched_at":"2026-11-06T16:42:41+00:00","note":null}],"documents":[{"id":87942,"url":"https://github.com/langgenius/dify/commit/7bfcf9185c75bb18f0b44335080524e659f087d9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87943,"url":"https://github.com/langgenius/dify/releases/tag/1.15.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":87944,"url":"https://www.vulncheck.com/advisories/dify-ssrf-protection-bypass-via-remote-files-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}