Is there a public PoC exploit available for CVE-2026-6617?

Yes, a public proof-of-concept exploit is available for CVE-2026-6617. Prioritise patching immediately. EPSS: 0.0%.

Dify CVE-2026-6617

Q: What is the CVSS score of CVE-2026-6617?

CVE-2026-6617 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23805 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-20 VulDB

SSRF Dify Langgenius

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 20, 2026 - 08:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 07:57 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 07:45 euvd

EUVD-2026-23805

Analysis Generated

Apr 20, 2026 - 07:45 vuln.today

CVE Published

Apr 20, 2026 - 07:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in langgenius dify up to 0.6.9. This vulnerability affects the function get_api_tool_provider_remote_schema of the file api/services/tools/api_tools_manage_service.py of the component ApiToolManageService. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery (SSRF) in Dify's ApiToolManageService allows authenticated remote attackers to manipulate the URL argument in the get_api_tool_provider_remote_schema function, enabling them to make arbitrary HTTP requests from the server. Affects Dify versions up to 0.6.9. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts.

Technical ContextAI

The vulnerability exists in the ApiToolManageService component (api/services/tools/api_tools_manage_service.py), specifically in the get_api_tool_provider_remote_schema function which handles fetching remote schemas for API tools. The root cause is improper validation of user-supplied URL parameters (CWE-918: Server-Side Request Forgery), allowing an attacker to redirect the server's internal HTTP requests to arbitrary destinations. This could enable reconnaissance of internal services, exfiltration of sensitive data, or attacks on internal infrastructure that would normally be inaccessible from outside the network. Dify is an open-source LLM application development platform that provides API tool integration capabilities, making this function a critical attack surface.

RemediationAI

Upgrade Dify to a patched version released after 0.6.9 immediately. However, vendor advisory details and specific patched version numbers are not confirmed in the provided data - contact Langgenius directly or check the Dify GitHub repository (https://github.com/langgenius/dify) for patch availability and exact upgrade instructions. As an immediate compensating control pending patching, restrict access to Dify's API endpoints to trusted internal networks only using a firewall or WAF, implement URL validation/allowlisting in the get_api_tool_provider_remote_schema function to restrict requests to approved external domains only (this requires code modification), and disable or restrict the API tool provider feature if it is not actively used. Additionally, implement network segmentation to prevent the Dify server from accessing internal services (restrict outbound connections from Dify to only required external APIs), and monitor outbound HTTP requests from the Dify application for suspicious destinations or access to internal IP ranges. Note that network segmentation may impact legitimate API tool functionality and should be carefully scoped.