Dify CVE-2026-6618

Exploitation requires: (1) authenticated access to the Dify API - the attacker must possess valid credentials or be a legitimate user with API access (PR:L in CVSS vector confirms this requirement); (2) the ability to submit or modify an OpenAI plugin configuration containing a malicious 'url' parameter; (3) the targeted URL must be reachable from the Dify server's network perspective (e.g., internal services on the same network, metadata endpoints if Dify is cloud-hosted). Default Dify installations are vulnerable if they expose the plugin configuration API to authenticated users. Non-default configurations or network segmentation that restricts the Dify server's outbound connectivity can reduce exposure.

CVSS 6.3 with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R indicates network-accessible SSRF with low attack complexity requiring authenticated access. The PR:L (low privilege) requirement is a significant limiting factor - this is not a pre-authentication attack. However, publicly available exploit code (E:P) and typical SSRF impact (confidentiality, integrity, availability across internal systems) elevates practical risk in multi-tenant or Internet-facing Dify deployments. The RL:X (remediation unknown) and RC:R (reasonable confidence) tags suggest the vendor has not issued patches or guidance. Real-world risk depends heavily on deployment context: if Dify is exposed to untrusted users who can authenticate (e.g., SaaS platform, public instance), risk is substantial despite PR:L requirement. If Dify is internal-only or behind strong access controls, risk is lower. The lack of vendor response is a negative signal for remediation timeline.

An authenticated user (e.g., an employee with access to a Dify instance, or an account created via public sign-up on a vulnerable deployment) submits a malicious OpenAI plugin configuration with a crafted URL pointing to an internal service (e.g., http://localhost:6379 for Redis, http://169.254.169.254/metadata for AWS metadata, or http://internal-api.example.com). When Dify parses the plugin JSON via parse_openai_plugin_json_to_tool_bundle, the unvalidated URL is used in an HTTP request made by the server. The attacker receives the response, leaking sensitive data, credentials, or internal service information.