NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

CVE-2024-35223 — dapr

MEDIUMFix: dapr/dapr@e0591e4

CVE-2024-35223 is a medium-severity (CVSS 5.3) Information Exposure vulnerability in github.com/dapr/dapr. A fix is available for github.com/dapr/dapr — see the affected versions and patch details below.

Dapr API Token Exposure

Also known asGHSA-284c-x8m7-9w5hGO-2024-2879
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-35223.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs38th percentile — riskier than 38% of all scored CVEsHighest risk
0.00%0.31%0.63%0.94%0.4%0.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐹github.com/dapr/dapr

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the invoked app.

Users who leverage Dapr for gRPC proxy service invocation and are using the app API token feature are encouraged to upgrade Dapr to version 1.13.3.

Impact

This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as the Dapr App API token functionality. An attacker could exploit this vulnerability to gain access to the app token of the invoker app, potentially compromising security and authentication mechanisms.

Patches

The issue has been fixed in Dapr version 1.13.3.

Details

Dapr uses two types of tokens for authentication:

  • APP_API_TOKEN: Used by Dapr to authenticate to the app.
  • DAPR_API_TOKEN: Used by the app to authenticate to Dapr.

Dapr uses the dapr-api-token metadata in gRPC calls (or header, for HTTP calls) for authentication.

  • In communication from dapr to the app, the dapr-api-token metadata field will carry the APP_API_TOKEN.
  • In communication from the app to daprd, the dapr-api-token metadata field will carry the DAPR_API_TOKEN.

Before version 1.13.0, the APP_API_TOKEN was not being sent to the invoked app for authentication, as reported in this issue. Instead, Dapr was incorrectly using the same DAPR_API_TOKEN that the invoker app had passed to Dapr. This was addressed in PR #7404, but the fix only worked for self-invocation scenarios.

When Dapr needed to communicate with another instance, it would mistakenly include the APP_API_TOKEN of the invoker app in the request. This behavior is incorrect, app tokens should never be included in requests between Dapr sidecars. This vulnerability allows the receiving app to see the app token of the invoker app, leading to potential misuse and security breaches.

The vulnerability is addressed by ensuring that Dapr uses the correct app token (of the invoked app) during gRPC proxy service invocation.

References

Credits

Thanks to Benjamin Delay for reporting this issue.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/dapr/dapr≥ 1.13.0&&< 1.13.31.13.3go get github.com/dapr/dapr@v1.13.3

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/dapr/dapr, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/dapr/dapr to 1.13.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-35223 is resolved across your whole dependency graph.

  3. Workarounds

    Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

### **Summary** A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the invoked app. Users who leverage Dapr for gRPC proxy service invocation and are using the app API token feature are encouraged to upgrade Dapr to version [1.13.3](https://github.com/dapr/dapr/releases/tag/v1.13.3). ### Impact This vulnerability impacts Dapr users who use Dapr as a gRPC proxy f
O3 Security · Impact-Aware SCA

Is CVE-2024-35223 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2024-35223: dapr — Fixed in 1.13.3