Skip to content
Fencer Vulns
medium 6.8

CVE-2023-37918 json

API token authentication bypass in HTTP endpoints in Dapr

published 2023-07-21 3 y ago modified 2026-09-10 1 mo ago also GHSA-59m6-82qm-vqgj , GO-2023-1955 , EUVD-2023-1966

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.

Patch / fix

  • go github.com/dapr/dapr 1.10.9, 1.11.2
  • dapr dapr 1.11.2

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.40% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/dapr/dapr
>=1.11.0, <1.11.2
<1.10.9
1.11.2
1.10.9

Affected products

  • dapr dapr

Classification

Weakness
  • CWE-287 Improper Authentication
  • CWE-305 Authentication Bypass by Primary Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.