CVE-2026-105761— Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
Quick assessment
Affected
langgenius dify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dify 是一个开源的大语言模型（LLM）应用开发平台。在版本 1.16.0 之前，API 控制器 中的 端点使用了 方法，该方法根据客户端提供的服务器 ID 直接检索对应的 ，但未验证该服务器是否属于请求的应用程序及其所属租户。因此，经过身份验证的工作区成员可以修改其他应用程序的 MCP 服务器状态和参数，可能导致数据重定向或服务停用。该问题已在版本 1.16.0 中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105761
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
Source: CVE Program / CVE List V5
Vulnerability Description
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| langgenius | dify | < 1.16.0 | - |
|
II. Public POCs for CVE-2026-105761
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105761
请登录查看更多情报信息。
Other References for CVE-2026-105761 (4)
-
https://github.com/langgenius/dify/pull/38177 x_refsource_MISC
-
https://github.com/langgenius/dify/releases/tag/1.16.0 x_refsource_MISC
-
https://github.com/langgenius/dify/security/advisories/GHSA-ccrj-frp2-c945 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: dify
-
CVE-2026-105762
Dify: Unauthenticated Server-Side Request Forgery in /consol -
CVE-2026-85022
langgenius dify WebApp Sign-In mail-and-password-auth.tsx ro -
CVE-2026-85021
langgenius dify Splash Layout splash.tsx router.replace cros -
CVE-2026-18632
langgenius dify Jinja2 jinja2_transformer.py jinja2.Template -
CVE-2026-18266
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerabil
Same vendor: langgenius
-
CVE-2026-105762
Dify: Unauthenticated Server-Side Request Forgery in /consol -
CVE-2026-85022
langgenius dify WebApp Sign-In mail-and-password-auth.tsx ro -
CVE-2026-85021
langgenius dify Splash Layout splash.tsx router.replace cros -
CVE-2026-18632
langgenius dify Jinja2 jinja2_transformer.py jinja2.Template -
CVE-2026-18266
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerabil
Same weakness: CWE-639
-
CVE-2026-105755
vLLM: Flash late-interaction scoring caches query embeddings -
CVE-2026-91107
openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR -
CVE-2026-105699
Langflow: Authenticated Cross-Project File Disclosure via Un -
CVE-2026-105698
Langflow: Cross-user flow access and vertex execution via de -
CVE-2026-97305
WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0
V. Comments for CVE-2026-105761
No comments yet