Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants

What it is

DifyTap is a chain of four vulnerabilities in Dify, the open-source agentic workflow platform (146,000+ GitHub stars), disclosed by Zafran Security researchers Ido Shani and Gal Zaban. Two are critical, two require no authentication, and three carry cross-tenant impact on Dify's multi-tenant cloud service. The core result: an attacker can silently read AI conversations from other customers' applications and establish a persistent exfiltration channel for every message and model response.

How it works

The keystone is CVE-2026-41947 (CVSS 9.1), an authorization bypass letting an authenticated editor set and enable trace configurations for any application regardless of tenant ownership. Because tenant checks are missing, an attacker can point a victim application's tracing at an attacker-controlled LLM trace provider, redirecting all messages and responses. Since anyone can freely register a Dify account and this covers all publicly accessible applications, this becomes a durable covert exfiltration channel.

The other three:

• CVE-2026-41948 (CVSS 9.4) — path traversal against the Plugin Daemon's internal REST API via insufficient URL path sanitization; authenticated users can reach internal, private endpoints.
• CVE-2026-41949 (CVSS 7.5/5.9) — authorization bypass in the file preview endpoint /console/api/files/{file_id}/preview; any authenticated user can read up to 3,000 characters of any uploaded document across all tenants using only the file's UUID.
• CVE-2026-41950 (CVSS 6.5) — authorization bypass letting an authenticated user read the full contents of another user's files within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request.

Separately, Dify's file parsing stack shipped a version of PDFium vulnerable to CVE-2024-5846 (CVSS 8.8), a two-year-old use-after-free enabling heap corruption via a crafted PDF.

Preconditions / Affected

Dify multi-tenant deployments prior to 1.14.2. Most of the chain requires only a self-registered account; the trace hijack requires an editor role but targets any accessible application. The two no-auth flaws (unauthenticated traversal of the Plugin Daemon API and triggering cross-tenant internal API calls) need no account at all.

What to do

Upgrade to Dify 1.14.2 (shipped last month), which fixes all flaws except CVE-2026-41948. The path traversal fix is pending and expected in the next release — treat exposed Plugin Daemon endpoints as still at risk until then.

Caveats

Zafran notes CVE-2026-41948 remains unpatched at time of writing. The company also flags that container-image deployment differences create visibility gaps traditional scanners miss, so version-based scanning alone may not confirm your exposure.