Dify CVE-2026-6617

The vulnerability requires an authenticated user account with permission to create or modify API tools in Dify. The attack is initiated by sending a crafted request to the get_api_tool_provider_remote_schema function with a manipulated URL argument pointing to internal resources (localhost, private IP ranges, or internal hostnames). No special configuration or non-default settings are required beyond having the API tool feature enabled, which is enabled by default in standard Dify deployments. The attack is limited to making HTTP requests from the server's perspective - actual exploitation impact depends on what services are accessible from the Dify server and what response data is returned and visible to the attacker. Exploitation requires network connectivity from the Dify server to the target internal service.

CVSS 6.3 with AV:N/AC:L/PR:L indicates remote network access with low complexity but requiring authenticated login (PR:L). The E:P field indicates proof-of-concept code is available, increasing real-world risk. The vulnerability affects confidentiality, integrity, and availability (C:L/I:L/A:L) at low impact level per confidentiality impact. However, SSRF vulnerabilities often carry underestimated risk: while individual impact is low, SSRF can serve as a pivot point for internal reconnaissance, data exfiltration, or chaining with other vulnerabilities. The requirement for authentication (PR:L) reduces blast radius compared to unauthenticated SSRF but still poses significant risk in multi-tenant environments or where user accounts are compromised. Vendor non-responsiveness to early disclosure significantly elevates concern. The real-world priority depends on deployment context: low risk in isolated internal deployments with trusted users, high risk in SaaS environments or where Dify users cannot be fully trusted.

An authenticated user with access to Dify's API tool creation feature supplies a malicious URL parameter (such as 'http://localhost:8080/admin' or 'http://internal-database:5432') to the get_api_tool_provider_remote_schema endpoint. The server processes this URL and makes an outbound HTTP request, allowing the attacker to read responses from internal services, access internal management panels, or probe the internal network topology. With publicly available exploit code, this attack requires minimal technical skill.