CVE-2026-6618 is a server-side request forgery vulnerability affecting langgenius dify versions 1.13.0 through 1.13.3. The issue resides in the parse_openai_plugin_json_to_tool_bundle function of api/core/tools/utils/parser.py, specifically in the ApiBasedToolSchemaParser component. An attacker can manipulate the url argument to cause the server to make unintended HTTP requests. The vulnerability is remotely exploitable and has a CVSS 4.0 score of 5.3 (medium severity). No patch or official remediation has been published, and the vendor has not responded to the disclosure.

Successful exploitation allows an attacker to induce the affected server to perform arbitrary HTTP requests, potentially accessing internal resources or services not otherwise reachable. This can lead to information disclosure or further attacks leveraging internal network access. However, the vulnerability does not require user interaction and has low complexity but limited impact as indicated by the medium CVSS score.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's channels for any future updates or patches. Until a fix is released, consider implementing network-level restrictions to limit outbound requests from the affected application and validate or sanitize input parameters where possible to reduce SSRF risk.