Executive Summary

This vulnerability is a flaw in the langgenius dify software up to version 1.13.3, specifically in the function parse_openai_plugin_json_to_tool_bundle within the file api/core/tools/utils/parser.py. The issue allows an attacker to manipulate the 'url' argument, which can lead to server-side request forgery (SSRF). This means an attacker can make the server send unauthorized requests to other internal or external systems. The attack can be launched remotely, and an exploit for this vulnerability has already been published.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to perform server-side request forgery (SSRF). This can lead to unauthorized access to internal systems, exposure of sensitive information, or interaction with internal services that are not intended to be accessible externally. Because the attack can be launched remotely, it increases the risk of exploitation without physical access to the server.

Useful 0 Not Useful 0

Detection Guidance

CVE-2026-6618 is a Blind Server-Side Request Forgery (SSRF) vulnerability that can be detected by monitoring for unusual outbound HTTP GET requests initiated by the vulnerable component when parsing OpenAI Plugin manifests.

Detection can involve submitting crafted OpenAI Plugin manifest JSON payloads with controlled api.url fields to observe server behavior and response times, which can indicate whether internal ports are open or closed.

Specifically, you can test the vulnerability by sending a POST request to the API endpoint `/console/api/workspaces/current/tool-provider/api/schema` with a malicious JSON payload containing an api.url pointing to internal or arbitrary network addresses (e.g., http://127.0.0.1:22).

Example command using curl to test the vulnerability (replace <payload.json> with your crafted JSON file):

• curl -X POST https://<target-host>/console/api/workspaces/current/tool-provider/api/schema -H "Content-Type: application/json" -d @<payload.json>

Monitoring server logs for outbound HTTP requests to unexpected internal IPs or ports and measuring response delays can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or disabling the vulnerable functionality that parses OpenAI Plugin manifests, especially the feature that allows importing custom tools from JSON.

Limit authenticated user permissions to prevent unauthorized access to the API endpoint `/console/api/workspaces/current/tool-provider/api/schema` used for importing schemas.

Implement network-level controls such as firewall rules to restrict outbound HTTP requests from the server to internal network resources.

Monitor and log outbound HTTP requests made by the application to detect suspicious activity.

Since the vendor has not responded, consider applying custom patches or disabling the vulnerable code path in `api/core/tools/utils/parser.py` if possible until an official fix is available.

Useful 0 Not Useful 0