CVE WATCH / VULNERABILITY DETAIL
CVE-2026-58141
HIGHCVSS 7.6NVD feed
Published 6 November 2026 · tracked since 7 November 2026
Description
Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without des
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-123998 HIGH 8.3
- CVE-2026-119924 HIGH 8.1
- CVE-2026-119923 CRITICAL 9.8
- CVE-2026-108262 MEDIUM 6.5
- CVE-2026-100080
- CVE-2026-89017 HIGH 7.5
- CVE-2026-75598 MEDIUM 6.3
- CVE-2026-123824 MEDIUM 6.3
- CVE-2026-102650 HIGH 7.5
- CVE-2026-85743 HIGH 8.2