CVE-2026-105761

Executive Summary

CVE-2026-105761 is an authorization bypass (IDOR / CWE-639) in Dify, an open-source LLM application development platform. Prior to version 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint retrieved an MCP server object by a client-supplied server ID without verifying that the server belonged to the requested application and tenant. Any authenticated workspace member could modify another application's MCP server status and parameters, enabling data redirection or denial of service. The vulnerability carries a CVSS score of 7.1 (High) and is currently unpatched in tracked sources.

Technical Analysis

Dify exposes an MCP (Model Context Protocol) server management interface through its console API. The affected endpoint is PUT /console/api/apps/<app_id>/server, implemented in api/controllers/console/app/mcp_server.py via the AppMCPServerController.put() method.

The root cause is a broken object-level authorization check, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). When processing a PUT request, the controller retrieves an AppMCPServer record using a server ID supplied by the client in the request. Critically, the lookup does not validate that the retrieved AppMCPServer object is associated with:

1. The app_id specified in the request path, and
2. The tenant (workspace) that the authenticated caller belongs to.

Because the ownership and tenant binding are not enforced at query time, an authenticated workspace member with access to the console API can reference a server ID belonging to a different application — including one in another tenant — and mutate its configuration. The app_id in the URL path becomes cosmetic rather than authoritative; the actual object acted upon is determined entirely by the attacker-supplied server ID.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L reflects:

• Network attack vector (API reachable over the network),
• Low attack complexity (no special conditions required beyond a valid session),
• Low privileges required (any authenticated workspace member),
• No user interaction,
• High integrity impact (MCP server status and parameters can be altered, potentially redirecting data flows),
• Low availability impact (the service can be disabled).

Note that confidentiality impact is rated None per the vector, while integrity and availability are affected. The modification of MCP server parameters is significant because MCP servers in Dify mediate tool/data connections for LLM applications; altering them can redirect where an application sends data or break its integrations entirely.

The fix in version 1.16.0 presumably adds a tenant- and application-scoped ownership check before the update is committed (the specific code change is not detailed in the available data).

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (broken object-level authorization) and the NVD description.

1. Reconnaissance / target identification. The attacker obtains a valid account as a workspace member in Dify (an authenticated, low-privilege position). The attacker identifies target MCP server IDs — either by enumerating their own accessible objects, observing identifiers returned by the API, or through other member-visible resources that leak server IDs. The attacker also identifies victim app_id values they wish to influence.

2. Triggering the flaw. The attacker issues an authenticated PUT request to /console/api/apps/<app_id>/server, supplying a server ID that does not belong to <app_id> or to the attacker's tenant. Because AppMCPServerController.put() fetches the server purely by the client-supplied ID without an ownership/tenant check, the object belonging to the other application is selected for modification.

3. Payload / execution method. At the vulnerability-class level, the request body carries updated MCP server parameters and status. Instead of modifying the attacker's own server, the update is applied to the victim's MCP server. No memory-corruption or code-execution payload is required — the flaw is an authorization logic error exercised through a normal authenticated API call.

4. Post-exploitation impact. By altering the victim's MCP server parameters, the attacker can redirect the data handled by the victim application's MCP integration toward attacker-controlled endpoints, or change status values to disable the MCP service. This affects the integrity of the victim application's tool/data wiring and can degrade availability of its MCP-backed functionality. Because the manipulation is performed through legitimate console API behavior, it may blend into normal administrative traffic.

Impact Assessment

The impact is scoped to the Dify deployment and the LLM applications running on it. The blast radius spans all applications and tenants reachable by server IDs that a given authenticated member can reference — the cross-tenant nature of the missing check means an attacker may affect applications outside their own workspace.

Business impact:

• Integrity (High): MCP server parameters can be silently modified, potentially redirecting the data an LLM application exchanges with external tools/services — a data-integrity and potential data-exfiltration concern for downstream integrations.
• Availability (Low): MCP server status changes can disable a service, causing functional outage of MCP-dependent features.
• Confidentiality (None per vector): The vector does not score confidentiality impact, though redirection of data flows could have secondary confidentiality implications depending on deployment.

Any organization operating Dify versions prior to 1.16.0 with multiple workspace members and MCP server usage should treat this as a High-severity authenticated authorization flaw. The Low privileges required (PR:L) means the barrier to exploitation is merely possession of a valid member account, which lowers the effective threat for deployments that permit broad account provisioning or self-registration.

Detection Guidance

Sigma Rule

title: Dify MCP Server Unauthorized Update via Console API
id: 7f3c1a92-4b2e-4e7a-9c1d-dify20261057
status: experimental
description: Detects PUT requests to the Dify console MCP server endpoint, which may indicate IDOR exploitation of CVE-2026-105761
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105761
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    http.method: 'PUT'
  selection_path:
    cs-uri-stem|contains: '/console/api/apps/'
  selection_endpoint:
    cs-uri-stem|endswith: '/server'
  condition: selection_method and selection_path and selection_endpoint
fields:
  - c-ip
  - cs-uri-stem
  - cs-username
falsepositives:
  - Legitimate MCP server configuration updates by application owners
level: medium

YARA Rule

rule CVE_2026_105761_Dify_MCP_IDOR
{
    meta:
        description = "Detects HTTP PUT requests targeting the Dify console MCP server endpoint associated with CVE-2026-105761"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105761"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "high"

    strings:
        $method = "PUT"
        $path1 = "/console/api/apps/"
        $path2 = "/server"
        $mcp = "mcp_server"

    condition:
        $method at 0 and $path1 and $path2 and $mcp
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105761 Dify MCP Server IDOR Attempt (PUT console MCP endpoint)"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/console/api/apps/"; http.uri; content:"/server"; http.uri; pcre:"/\/console\/api\/apps\/[^\/]+\/server/"; classtype:attempted-admin; reference:cve,2026-105761; sid:2026105761; rev:1;)

Elastic Detection

http where http.request.method == "PUT" and
  startsWith(http.request.uri.path, "/console/api/apps/") and
  endsWith(http.request.uri.path, "/server")

Splunk SPL Query

index=web sourcetype=dify OR sourcetype=access_combined
| search method=PUT uri_path="/console/api/apps/*/server"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="dify,web,accesslog,">
  <rule id="2026105" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <id>31100</id>
    <match>PUT</match>
    <url>/console/api/apps/</url>
    <description>CVE-2026-105761: Possible Dify MCP server IDOR - PUT request to console MCP server endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED in tracked sources; no vendor workaround confirmed.

1. Immediate mitigations

   • Restrict access to the Dify console API (/console/api/apps/...) to trusted networks/administrators; do not expose it broadly.
   • Enforce strict least-privilege on workspace membership; avoid provisioning accounts to untrusted or self-registered users.
   • If feasible, audit and reconcile MCP server configurations; monitor for unexpected parameter or status changes on MCP server objects.
   • Deploy the detection rules above to flag PUT requests to /console/api/apps/<app_id>/server for review.

2. Patch / upgrade steps

   • Version 1.16.0 is reported to include the fix per the NVD description. No patch source, commit reference, or vendor advisory is currently tracked by monitored sources (patch confidence 0/4).
   • Verify the fix directly against the official Dify repository / release notes before relying on it; confirm the release that ships the tenant- and application-bound ownership check in AppMCPServerController.put().
   • Because no patch evidence is available from tracked sources, treat deployments as unpatched until independently validated.

3. Long-term hardening

   • Adopt consistent object-level authorization patterns: always scope queries for client-supplied IDs by the authenticated tenant and the parent resource (e.g., verify server belongs to <app_id> and the caller's tenant).
   • Implement automated authorization testing (IDOR/BOLA checks) in the CI/CD pipeline for API controllers.
   • Add centralized audit logging of all object mutations with tenant and resource attribution to aid investigation.
   • Monitor Dify project releases for the security fix and subscribe to vendor advisories.

References

• NVD — CVE-2026-105761: https://nvd.nist.gov/vuln/detail/CVE-2026-105761
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Dify project repository / release notes (confirm version 1.16.0 fix): https://github.com/langgenius/dify

No public PoC, exploit code, or Nuclei template is currently available (POC_STATUS: None). CVE-2026-105761 is not listed in CISA KEV. No threat-actor campaigns or in-the-wild exploitation evidence are documented at this time.