The flaw exists in langgenius dify’s ApiToolManageService get_api_tool_provider_remote_schema function, where an attacker can manipulate the url argument to trigger arbitrary HTTP calls from the server. This SSRF allows the adversary to reach internal or external resources, potentially exposing confidential data or enabling lateral movement. The vulnerability is classified as CWE‑918 and can compromise data confidentiality and integrity, though it does not provide direct code execution.

langgenius dify software versions up to 0.6.9 are affected. The issue resides in the api/services/tools/api_tools_manage_service.py file, so any deployment of dify 0.6.9 or earlier remains vulnerable until updated.

The CVSS score of 5.3 denotes a moderate severity. The EPSS score is not available, but the flaw has been publicly disclosed and is exploitable from remote clients. It is not yet listed in the CISA KEV catalog. The attack vector is remote, exploiting the server’s ability to resolve and fetch any URL specified by the attacker, potentially targeting internal services.