Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Dapr can be tricked to trust attacker‑controlled keys

CVE-2026-59096 · published 4 months ago
Summary

Dapr’s identity service builds its login configuration using the web address it sees in incoming requests. If the server is left at default settings, an attacker can send a fake address header and cause Dapr to point to a malicious source for verification keys, allowing forged login tokens to be accepted. Fix it by setting a specific trusted address list or disabling the automatic discovery feature.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dapr dapr 1.17.0
Original advisory text
Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host
Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured (the default), and serves the document with a one-hour public cache lifetime. A remote unauthenticated attacker can poison the discovery document so relying parties performing dynamic (unpinned) discovery fetch the JWKS from an attacker-controlled server, causing attacker-signed JWTs to be accepted. Exploitation requires the OIDC server enabled without a configured jwt-issuer or oidc-allowed-hosts.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-346Origin Validation Error
Timeline
Published2 Jul 2026
Updated4 Nov 2026
First seen2 Jul 2026
Sources
CVE-2026-59096 · NVD
CVE-2026-59096 · MITRE
CVE-2026-59096 · OSV
Track software like this
Free during beta