CVE-2026-59096: Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host
Dapr Sentry's OIDC discovery endpoint derives the issuer and jwksuri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured (the default), and serves the document with a one-hour public cache lifetime. A remote unauthenticated attacker can poison the discovery document so relying parties performing dynamic (unpinned) discovery fetch the JWKS from an attacker-controlled server, causing attacker-signed JWTs to be accepted. Exploitation requires the OIDC server enabled without a configured jwt-issuer or oidc-allowed-hosts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure 'oidc-allowed-hosts' for the Dapr Sentry OIDC discovery endpoint so it does not honor attacker-controlled 'X-Forwarded-Host' when deriving the issuer and 'jwks_uri' from /.well-known/openid-configuration.
Dapr Sentry OIDC discovery endpoint oidc-allowed-hosts = configured to an explicit allowlist (non-empty) - Configuration
Enable the OIDC server configuration with 'jwt-issuer' explicitly configured so the discovery document issuer/JWKS values are not derived from attacker-influenced request headers.
Dapr Sentry OIDC configuration jwt-issuer = set to a specific expected issuer - Compensating control
Place a reverse proxy/load balancer in front of Dapr that strips or overwrites the 'X-Forwarded-Host' header so only trusted values reach the OIDC discovery endpoint.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59096?
CVE-2026-59096 has a severity rating of 8.2, categorized as high.
How do I fix CVE-2026-59096?
To mitigate CVE-2026-59096, configure an allowed-hosts list to validate the X-Forwarded-Host header.
What software is affected by CVE-2026-59096?
CVE-2026-59096 affects the Dapr Sentry component within the Dapr framework.
What type of attack does CVE-2026-59096 enable?
CVE-2026-59096 enables attackers to inject malicious issuer and JWKS URI through an unvalidated X-Forwarded-Host header.
Is user interaction required to exploit CVE-2026-59096?
No, CVE-2026-59096 does not require user interaction to be exploited.