{"cve":"CVE-2023-37918","nvd":{"published":"2023-07-21T21:15:11.657","modified":"2026-06-17T06:08:54.090","status":"Modified","description":"Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-287"],"references":["https://docs.dapr.io/operations/security/api-token/","https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a","https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj","https://docs.dapr.io/operations/security/api-token/","https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a"],"products":["linuxfoundation:dapr"],"source":"nvd","synced_at":"2026-10-19T21:38:35.729974749+00:00"},"epss":{"cve":"CVE-2023-37918","score":0.01397,"percentile":0.72429,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-59m6-82qm-vqgj","url":"https://osv.dev/vulnerability/GHSA-59m6-82qm-vqgj","summary":"Dapr API token authentication bypass in HTTP endpoints","modified":"2026-09-10T03:49:54.328619840Z","packages":[{"ecosystem":"Go","name":"github.com/dapr/dapr","purl":"pkg:golang/github.com/dapr/dapr","ranges":[">=1.11.0 <1.11.2"],"fixed":["1.11.2"]},{"ecosystem":"Go","name":"github.com/dapr/dapr","purl":"pkg:golang/github.com/dapr/dapr","ranges":["<1.10.9"],"fixed":["1.10.9"]}]},{"id":"GO-2023-1955","url":"https://osv.dev/vulnerability/GO-2023-1955","summary":"Dapr API token authentication bypass in HTTP endpoints in github.com/dapr/dapr","modified":"2026-03-03T04:51:32.173795Z","packages":[{"ecosystem":"Go","name":"github.com/dapr/dapr","purl":"pkg:golang/github.com/dapr/dapr","ranges":["<1.10.9",">=1.11.0 <1.11.2"],"fixed":["1.10.9","1.11.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}