CVE-2024-35223

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as the Dapr App API token functionality. An attacker could exploit this vulnerability to gain access to the app token of the invoker app, potentially compromising security and authentication mechanisms. This vulnerability was patched in version 1.13.3.

• CWE-200

• https://github.com/dapr/dapr/commit/e0591e43d0cdfd30a2f2960dce5d9892dc98bc2c
• https://github.com/dapr/dapr/issues/7344
• https://github.com/dapr/dapr/pull/7404
• https://github.com/dapr/dapr/releases/tag/v1.13.3
• https://github.com/dapr/dapr/security/advisories/GHSA-284c-x8m7-9w5h
• https://github.com/dapr/dapr/commit/e0591e43d0cdfd30a2f2960dce5d9892dc98bc2c
• https://github.com/dapr/dapr/issues/7344
• https://github.com/dapr/dapr/pull/7404
• https://github.com/dapr/dapr/releases/tag/v1.13.3
• https://github.com/dapr/dapr/security/advisories/GHSA-284c-x8m7-9w5h

Published

May 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35218Umbraco CMS is an ASP.NET CMS used by more than 730.000 webs…4.8
• CVE-2024-35219OpenAPI Generator allows generation of API client libraries …8.3
• CVE-2024-3522A vulnerability classified as critical has been found in Cam…8.8
• CVE-2024-35220@fastify/session is a session plugin for fastify. Requires t…7.4
• CVE-2024-35221Rubygems.org is the Ruby community's gem hosting service. A …4.3
• CVE-2024-35222Tauri is a framework for building binaries for all major des…5.9
• CVE-2024-35224OpenProject is the leading open source project management so…5.4
• CVE-2024-35225Jupyter Server Proxy allows users to run arbitrary external …6.1
• CVE-2024-35226Smarty is a template engine for PHP, facilitating the separa…7.3
• CVE-2024-35227Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2024-35228Wagtail is an open source content management system built on…5.5
• CVE-2024-35229ZKsync Era is a layer 2 rollup that uses zero-knowledge proo…5.3