Dapr Sentry OIDC Discovery Cache Poisoning

Executive Summary

CVE-2026-59096 is a security vulnerability in Dapr's Sentry component related to OpenID Connect (OIDC) discovery. The vulnerability occurs because the OIDC discovery endpoint derives the issuer and jwks_uri fields from the request's Host header or the X-Forwarded-Host header without proper validation when no allowed-hosts list is configured (which is the default).

An attacker can exploit this by sending a request with a spoofed X-Forwarded-Host header to poison the /.well-known/openid-configuration document. This causes relying parties that perform dynamic OIDC discovery without pinning the issuer to fetch JSON Web Key Sets (JWKS) from an attacker-controlled server, potentially accepting attacker-signed JWTs.

The vulnerability requires that the OIDC server is enabled without a configured jwt-issuer or oidc-allowed-hosts, and it arises because the system honors the X-Forwarded-Host header unconditionally by default.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a remote unauthenticated attacker to poison the OIDC discovery document, causing relying parties to fetch JWKS from an attacker-controlled server.

As a result, attacker-signed JWTs could be accepted by systems relying on the compromised OIDC discovery, potentially leading to unauthorized access or impersonation.

This can compromise the integrity of authentication and authorization processes in applications using Dapr's Sentry component for OIDC.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking if the Dapr Sentry OIDC discovery endpoint is accessible and whether it improperly honors the X-Forwarded-Host header without validation.

You can test the /.well-known/openid-configuration endpoint by sending HTTP requests with a spoofed X-Forwarded-Host header and observing if the issuer and jwks_uri fields in the response reflect the spoofed header.

Example curl command to test the vulnerability:

• curl -H "X-Forwarded-Host: attacker.com" http://<dapr-sentry-host>/.well-known/openid-configuration

If the issuer or jwks_uri in the response contains the attacker.com domain, the system is vulnerable.

Additionally, verify if the --oidc-allowed-hosts flag is configured; absence of this flag or an empty allowlist indicates vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, configure the --oidc-allowed-hosts flag with a non-empty allowlist of trusted hostnames.

This ensures that the X-Forwarded-Host header is only honored when it matches an allowed host, preventing attacker-controlled injection.

Alternatively, explicitly set the --jwt-issuer flag to a fixed issuer value to avoid dynamic issuer derivation.

If you rely on reverse proxies forwarding the X-Forwarded-Host header, ensure that the proxies and Dapr configuration align with the allowlist to maintain functionality securely.

Also, upgrade Dapr to version 1.17.8 or later where this fix is implemented.

Useful 0 Not Useful 0