Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-6617: Langgenius Dify 0.6.9: Server-Side Request Forgery Risk

CVE-2026-6617 · published 6 months ago

Summary

Langgenius Dify versions up to 0.6.9 are vulnerable to a server-side request forgery attack. This means that an attacker could trick the system into making unauthorized requests on behalf of the server, potentially accessing sensitive data. Update to version 0.7.0 or later to fix the issue.

Original advisory text

A vulnerability was detected in langgenius dify up to 0.6.9. This vulnerability affects the function get_api_tool_provider_remote_schema of the file api/services/tools/api_tools_manage_service.py of the component ApiToolManageService. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published20 Apr 2026

Updated29 Oct 2026

First seen20 Apr 2026

Sources

CVE-2026-6617 · NVD

Track software like this

Free during beta