Dify CVE-2026-105762: Unauthenticated SSRF in Remote-File Upload Reaches Internal Services and Cloud Metadata
Dify before 1.13.0 let unauthenticated callers make the server fetch any URL via its remote-files routes. Upgrade, restrict egress, enforce IMDSv2.
· 5 min