DifyTap: Critical Flaws in Dify Expose AI Chats Across Tenants

Cybersecurity researchers at Zafran Security have disclosed four vulnerabilities in Dify, the open-source agentic workflow platform boasting more than 146,000 GitHub stars, that could allow attackers to silently read AI conversations from other customers' applications without authentication. Codenamed DifyTap by researchers Ido Shani and Gal Zaban, the flaw set includes two critical-severity defects, two requiring no authentication, and three carrying cross-tenant impact on Dify's multi-tenant cloud service, enabling one customer's data to be exposed to another. Because anyone can freely register for a Dify account, the researchers warned that an attacker could configure tracing for any publicly accessible application and redirect all messages and model responses to an attacker-controlled LLM trace provider.

The disclosed vulnerabilities include CVE-2026-41947 (CVSS 9.1), an authorization bypass allowing authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership; CVE-2026-41948 (CVSS 9.4), a path traversal flaw enabling authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization; CVE-2026-41949 (CVSS 7.5/5.9), an authorization bypass in the file preview endpoint ("/console/api/files/{file_id}/preview") that lets any authenticated user read up to 3,000 characters of any uploaded document across all tenants using only the file's UUID; and CVE-2026-41950 (CVSS 6.5), an authorization bypass allowing authenticated users to read full file contents uploaded by other users within the same tenant by supplying an arbitrary file UUID in a chat-messages request. The combined effect creates a covert exfiltration channel for every message and model response, while also enabling unauthenticated traversal of Dify's internal Plugin Daemon API.

Separately, Zafran discovered that Dify's file parsing stack relied on a vulnerable version of PDFium, the open-source C++ PDF rendering library, exposing the platform to CVE-2024-5846 (CVSS 8.8), a two-year-old use-after-free bug that could allow remote attackers to exploit heap corruption via a crafted PDF file. The chain of authorization failures also allows attackers to preview documents uploaded by other tenants and leak files across users within a tenant by referencing another user's unique file identifier. Organizations running Dify in multi-tenant deployments should treat this disclosure as urgent and audit their cloud configurations immediately.

For security teams tasked with assessing exposure from such multi-tenant cloud flaws, verifying the integrity of encrypted communications is a critical first step. Admins can validate their deployments using an SSL/TLS checker to confirm certificate health and proper transport security. Teams should also use a breach checker to monitor whether exposed tenant data has surfaced in public dumps, and review authentication hygiene with a password strength audit to ensure editor-level credentials meet policy requirements. Patching Dify instances to the latest vendor release and restricting public access to Dify applications should be prioritized until the vulnerabilities are fully remediated.