Dapr vulnerabilities
We track 3 vulnerabilities in Dapr products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2026.
Latest Dapr vulnerabilities
- 7.5 High severity
dapr: Origin Validation Error
Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured (
- 8.1 High severity
dapr: Improper Limitation of a Pathname to a Restricted Directory
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows by
- 7.5 High severity
dapr: Improper Authentication
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from th