CVE-2026-6618
Server-Side Request Forgery in langgenius dify ApiBasedToolSchemaParser
Publication date: 2026-04-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| langgenius | dify | to 1.13.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2026-6618 is a Blind Server-Side Request Forgery (SSRF) vulnerability that can be detected by monitoring for unusual outbound HTTP GET requests initiated by the vulnerable component when parsing OpenAI Plugin manifests.
Detection can involve submitting crafted OpenAI Plugin manifest JSON payloads with controlled api.url fields to observe server behavior and response times, which can indicate whether internal ports are open or closed.
Specifically, you can test the vulnerability by sending a POST request to the API endpoint `/console/api/workspaces/current/tool-provider/api/schema` with a malicious JSON payload containing an api.url pointing to internal or arbitrary network addresses (e.g., http://127.0.0.1:22).
Example command using curl to test the vulnerability (replace <payload.json> with your crafted JSON file):
- curl -X POST https://<target-host>/console/api/workspaces/current/tool-provider/api/schema -H "Content-Type: application/json" -d @<payload.json>
Monitoring server logs for outbound HTTP requests to unexpected internal IPs or ports and measuring response delays can help detect exploitation attempts.
Can you explain this vulnerability to me?
This vulnerability is a flaw in the langgenius dify software up to version 1.13.3, specifically in the function parse_openai_plugin_json_to_tool_bundle within the file api/core/tools/utils/parser.py. The issue allows an attacker to manipulate the 'url' argument, which can lead to server-side request forgery (SSRF). This means an attacker can make the server send unauthorized requests to other internal or external systems. The attack can be launched remotely, and an exploit for this vulnerability has already been published.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to perform server-side request forgery (SSRF). This can lead to unauthorized access to internal systems, exposure of sensitive information, or interaction with internal services that are not intended to be accessible externally. Because the attack can be launched remotely, it increases the risk of exploitation without physical access to the server.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling the vulnerable functionality that parses OpenAI Plugin manifests, especially the feature that allows importing custom tools from JSON.
Limit authenticated user permissions to prevent unauthorized access to the API endpoint `/console/api/workspaces/current/tool-provider/api/schema` used for importing schemas.
Implement network-level controls such as firewall rules to restrict outbound HTTP requests from the server to internal network resources.
Monitor and log outbound HTTP requests made by the application to detect suspicious activity.
Since the vendor has not responded, consider applying custom patches or disabling the vulnerable code path in `api/core/tools/utils/parser.py` if possible until an official fix is available.