Four unpatched vulnerabilities in the open-source artificial intelligence platform Dify could allow attackers to silently exfiltrate sensitive data from other tenants in multi-tenant cloud configurations, exposing more than one million AI applications to potential compromise. Discovered by researchers at Zafran Security and collectively named DifyTap, the flaws enable a range of cross-tenant attacks, including the reading of private chat messages, unauthorized API calls, and the theft of uploaded documents and files.
What Is Dify and Why These Vulnerabilities Matter
Dify is a popular LLMOps platform used to build, deploy, and monitor AI-powered applications. It supports over one million applications across more than 50 industries, making it a high-value target for attackers seeking access to sensitive conversational data, proprietary business logic, and user-uploaded content. The DifyTap vulnerabilities are particularly dangerous because they require only a valid console user account — available to anyone who registers on the platform — and can be exploited without any administrative privileges.
Breakdown of the Four DifyTap Flaws
CVE-2026-41947 — Tracing Feature Allows Persistent Data Exfiltration (CVSS 9.1)
The most critical flaw resides in Dify’s tracing functionality, which is designed to help developers profile and monitor their AI applications. The relevant API endpoints failed to validate the sender’s tenant association, meaning an attacker could send requests to configure tracing for any application hosted on the same Dify instance. Once tracing is enabled on a target application, the attacker gains a persistent channel to intercept every message and response flowing through that application. Because the exploit works against any publicly accessible application, the potential scope of data leakage is massive.
CVE-2026-41948 — Plugin Daemon Enables Cross-Tenant API Calls (CVSS 9.4)
The second vulnerability affects the plugin daemon responsible for managing and executing Dify plugins. Two separate primitives within the daemon give attackers the ability to make arbitrary GET and POST requests to any API endpoint. These primitives can be chained with path-traversal techniques to access plugin icons belonging to other tenants or to manipulate settings in other tenants’ environments. The CVSS score of 9.4 reflects the ease of exploitation and the severe confidentiality and integrity impact.
CVE-2026-41949 and CVE-2026-41950 — File Handling Flaws Leak User Data
The remaining two vulnerabilities are rated high severity and concern Dify’s file identification and access permission mechanisms. CVE-2026-41949 allows an attacker to preview files uploaded by other tenants without proper authorization, while CVE-2026-41950 enables the retrieval of files uploaded by other users within the same tenant environment. Together, these flaws undermine the multi-tenant isolation that cloud-hosted Dify deployments depend on.
Additional Risk: Outdated PDF Parsing Library
Zafran also identified that for approximately 18 months — until December 21, 2025 — the PDF preview endpoint in Dify relied on Chromium PDFium binary version 126.0.6462.0, which is susceptible to CVE-2024-5846, a use-after-free vulnerability disclosed in June 2024. While this issue was not directly exploited in the DifyTap chain, it represents an additional attack surface in environments where the PDF preview feature is enabled.
What Affected Users Should Do Now
Dify released version 1.14.2, which includes patches for all four DifyTap vulnerabilities. Any organization running a self-hosted Dify instance or using a multi-tenant cloud deployment should update to this version immediately. In addition to patching, administrators should deploy web application firewall (WAF) rules specifically designed to mitigate exploitation attempts targeting CVE-2026-41948. For organizations using a managed Dify cloud service, confirm with the provider that the patched version has been deployed and that tenant isolation has been verified. Users who interact with Dify-powered applications should be aware that their chat histories and uploaded files may have been exposed; changing passwords and enabling multi-factor authentication on any accounts linked to those applications is a prudent precaution. As a broader security measure, organizations running AI platforms should implement a robust endpoint protection solution with behavioral analysis capabilities to detect anomalous API calls and data-access patterns that may indicate a cross-tenant breach.
