CVE-2026-105762: 
Dify vulnerability analysis and mitigation

CVE-2026-105762 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Dify, an open-source LLM application development platform. The flaw exists in the /console/api/remote-files/upload endpoint (api/controllers/web/remote_files.py), which accepted attacker-controlled URLs without enforcing authentication, causing the Dify server to fetch arbitrary URLs on behalf of the attacker. All Dify versions prior to 1.13.0 are affected; the issue was disclosed via a GitHub Security Advisory on May 19, 2026, and patched in version 1.13.0 released February 11, 2026. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the /console/api/remote-files/upload endpoint in api/controllers/console/remote_files.py used the fastopenapi routing framework, which inadvertently bypassed authentication middleware and treated all users as anonymous. As a result, the url parameter in the JSON POST body was passed directly to ssrf_proxy.head() / ssrf_proxy.get() without any authentication check, URL allowlist validation, or private IP range filtering. The fix (PR #32236) migrated the endpoint to Flask-RESTX Resource classes and applied the @login_required decorator, ensuring authentication is enforced before any outbound request is made (GitHub Advisory, Fix PR, Fix Commit).

An unauthenticated remote attacker can force the Dify server to issue HTTP requests to arbitrary destinations, including cloud instance metadata endpoints (e.g., http://169.254.169.254 for AWS/GCP IAM credentials), internal services on private IP ranges (e.g., 10.0.0.0/8, 127.0.0.1), and other network resources inaccessible from the public internet. This enables sensitive data exposure (including cloud credentials), internal network reconnaissance, and use of the Dify server as a pivot point for lateral movement. Additionally, the SSRF can be leveraged to flood internal services, creating a denial-of-service condition (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a single unauthenticated HTTP POST request with a malicious URL in the JSON body — no prior access or credentials are required. The vulnerability is classified as automatable (no user interaction needed) with network-level access. The EPSS score is approximately 0.345%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. No specific threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Dify instances running versions prior to 1.13.0 using tools like Shodan or Censys, searching for the Dify web interface or API banner.
2. Craft the malicious request: Prepare an unauthenticated HTTP POST request targeting the vulnerable endpoint:

   POST /console/api/remote-files/upload HTTP/1.1
   Host: <target-dify-host>
   Content-Type: application/json
   
   {"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}

3. Target internal or metadata services: Replace the URL with the desired internal target — cloud metadata endpoints (e.g., http://169.254.169.254 for AWS IAM credentials), internal services (http://10.0.0.1:8080), or an attacker-controlled server for out-of-band confirmation.
4. Receive the response: The Dify backend fetches the specified URL and returns the response body to the attacker, potentially exposing IAM credentials, internal service data, or network topology information.
5. Pivot or escalate: Use obtained cloud credentials or internal service responses to escalate privileges, move laterally within the target's infrastructure, or enumerate further internal resources (GitHub Advisory).

• Network: Outbound HTTP requests from the Dify server to cloud metadata IPs (e.g., 169.254.169.254, 100.100.100.200), private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or unexpected external IPs; unusual HTTP traffic originating from the Dify API process.
• Logs: Web/API access logs showing unauthenticated POST requests to /console/api/remote-files/upload with a JSON body containing a url field pointing to internal or metadata addresses; repeated requests from a single external IP to this endpoint.
• Process: The Dify API process (python/gunicorn/uvicorn) initiating outbound HTTP connections to non-standard destinations, particularly metadata service IPs or internal network hosts not normally accessed by the application.

The primary remediation is to upgrade Dify to version 1.13.0 or later, which enforces authentication on the /console/api/remote-files/upload endpoint via the @login_required decorator (Dify Release 1.13.0, Fix Commit). For deployments that cannot immediately upgrade, implement network-level controls to block the Dify server's outbound access to private/reserved IP ranges (e.g., 169.254.169.254, 127.0.0.1, 10.0.0.0/8) and cloud metadata endpoints. Additionally, consider placing the Dify API behind a WAF or reverse proxy that restricts unauthenticated access to sensitive API endpoints, and implement egress filtering on the host or container level (GitHub Advisory).

The Dify maintainers acknowledged the report and confirmed the fix was included in PR #32236, noting in the advisory that the patched version is 1.13.0. The Gemini Code Assist automated reviewer independently flagged the SSRF risk during the PR review, highlighting that both GET and POST endpoints accepted user-provided URLs without sufficient validation. No significant broader media coverage or notable external researcher commentary beyond the advisory and automated tooling has been identified (GitHub Advisory, Fix PR).