Is there a public PoC exploit available for CVE-2026-6618?

Yes, a public proof-of-concept exploit is available for CVE-2026-6618. Prioritise patching immediately. EPSS: 0.0%.

Dify CVE-2026-6618

Q: What is the CVSS score of CVE-2026-6618?

CVE-2026-6618 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23807 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-20 VulDB

SSRF Dify Langgenius

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 20, 2026 - 09:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 08:57 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 08:45 euvd

EUVD-2026-23807

Analysis Generated

Apr 20, 2026 - 08:45 vuln.today

CVE Published

Apr 20, 2026 - 07:45 nvd

LOW 2.1

DescriptionCVE.org

A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils/parser.py of the component ApiBasedToolSchemaParser. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in Dify up to version 1.13.3 allows authenticated remote attackers to manipulate the URL argument in the ApiBasedToolSchemaParser component, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability affects the parse_openai_plugin_json_to_tool_bundle function in api/core/tools/utils/parser.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.

Technical ContextAI

The vulnerability resides in the ApiBasedToolSchemaParser component of Dify, an open-source LLM application development framework. The parse_openai_plugin_json_to_tool_bundle function processes OpenAI plugin JSON manifests to construct tool schemas. The flaw occurs because user-supplied URL parameters are not properly validated or restricted before being used in server-side HTTP requests, violating CWE-918 (Server-Side Request Forgery). This allows attackers to craft malicious plugin configurations that cause the Dify server to make unintended requests to arbitrary targets, potentially accessing internal services, metadata endpoints, or external systems not otherwise reachable by the attacker.

RemediationAI

Immediate action: upgrade Dify to a version later than 1.13.3 once available. Since the vendor has not responded to disclosure and no patch version is currently confirmed in available references, monitor the official Dify GitHub repository (https://github.com/langgenius/dify) and VulDB for patch releases. As a temporary compensating control, restrict network access to the Dify API endpoint to trusted users and networks only, reducing the attack surface to authenticated users you control. Additionally, implement strict URL validation in the ApiBasedToolSchemaParser by adding a whitelist of allowed domains for OpenAI plugin URLs and blocking requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1/8, and metadata service endpoints like 169.254.169.254). Monitor outbound HTTP/HTTPS connections from the Dify server for unexpected external requests. These controls reduce but do not eliminate the risk until a vendor patch is available.