A flaw in Dapr’s service invocation logic allows an attacker to craft method paths that include reserved URL characters and path traversal sequences, causing the ACL system to evaluate a normalized path that differs from the one received by the target application. This mismatch enables the attacker to bypass configured access control policies and invoke services that should be forbidden, compromising the confidentiality and integrity of those services. The weakness maps to path traversal (CWE‑22) and access control failure (CWE‑284).

The vulnerability affects any Dapr deployment using a version between 1.3.0 and before 1.15.14, between 1.16.0‑rc.1 and before 1.16.14, or between 1.17.0‑rc.1 and before 1.17.5. The issue has been fixed in Dapr releases 1.15.14, 1.16.14, and 1.17.5, so deployments using those or newer versions are not impacted.

The CVSS score of 8.1 classifies the flaw as high severity. EPSS information is currently unavailable, so the probability of exploitation cannot be quantified, but the flaw is not listed in the CISA KEV catalog. The likely attack vector is external; any actor capable of sending a crafted service invocation request to a Dapr-enabled service can exploit the path traversal to bypass ACL controls, potentially exposing protected services and data.