Linuxfoundation Dapr vulnerabilities

2 CVEs affecting Linuxfoundation Dapr, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41491, published 2026-05-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-37918, published 2023-07-21. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is…
CVE-2026-41491, published 2026-05-08. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before…