DifyTap: Four Dify Flaws Exposed Cross-Tenant AI Chats
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Zafran Security researchers Ido Shani and Gal Zaban disclosed four vulnerabilities in Dify, an open-source agentic workflow platform with more than 146,000 GitHub stars, collectively codenaming the set "DifyTap."
- The flaws included two critical-severity bugs, two requiring no authentication, and three with cross-tenant impact on Dify's multi-tenant cloud service, allowing one customer's data to be exposed to another.
- CVE-2026-41948 (CVSS 9.4), a path-traversal flaw in the Plugin Daemon's internal REST API, and CVE-2026-41947 (CVSS 9.1), an authorization bypass enabling attackers to redirect trace configurations, were the two critical-severity issues.
- CVE-2026-41949 (CVSS 7.5/5.9) let any authenticated user read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID, while CVE-2026-41950 (CVSS 6.5) allowed reading the full contents of files uploaded by other users in the same tenant.
- Zafran separately found Dify's file parsing stack relied on a version of PDFium vulnerable to CVE-2024-5846 (CVSS 8.8), a two-year-old use-after-free bug that could be triggered via a crafted PDF.
- Anyone can freely register for a Dify account, and the missing tenant ownership checks let an attacker configure their own tracing on any publicly accessible application, creating a persistent exfiltration channel for every message and model response.
- Three of the four CVEs were fixed in Dify version 1.14.2, shipped last month; a fix for CVE-2026-41948 is expected in the next release.
Why it matters: Dify's multi-tenant cloud service hosted AI chat applications for a user base spanning more than 146,000 GitHub stars, and three of the four flaws had cross-tenant impact — meaning any registered user could read messages, responses, and uploaded documents belonging to other customers. With free sign-up and a persistent exfiltration channel, the attack surface was wide open. One critical CVE (9.4) remains unpatched as of disclosure.
