{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adifydify/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dify:dify:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-58141"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Dify (\u003c 1.15.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Dify"],"content_html":"\u003cp\u003eDify versions prior to 1.15.0 contain a server-side request forgery (SSRF) vulnerability that permits authenticated console users to bypass security protections. The vulnerability stems from a Squid proxy configuration that lacks destination deny rules and a make_request() helper function that fails to perform independent destination IP validation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAuthenticated attackers can reach internal infrastructure, including sandbox environments, internal APIs, and PostgreSQL databases. On AWS deployments, attackers may leverage this flaw to access the instance metadata service to retrieve IAM credentials. The HTTP Request workflow node further enables unauthorized POST, PUT, and DELETE operations against internal services that rely on network isolation for authorization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Dify to version 1.15.0 or later immediately to apply the patch for CVE-2026-58141.\u003c/li\u003e\n\u003cli\u003eAudit application logs for abnormal outbound requests originating from the Dify backend.\u003c/li\u003e\n\u003cli\u003eImplement stricter network segmentation (egress filtering) for the Dify environment to prevent internal network scanning and unauthorized access to cloud metadata services.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T17:26:35Z","date_published":"2026-11-06T17:26:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dify-ssrf/","summary":"Dify versions prior to 1.15.0 contain a server-side request forgery (SSRF) vulnerability allowing authenticated users to access internal network services and cloud metadata via misconfigured proxy settings.","title":"Dify: Server-side request forgery (CVE-2026-58141)","url":"https://feed.craftedsignal.io/briefs/2026-11-dify-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:dify:dify:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}