DifyTap Flaws Expose AI Data Across Tenants on Platform Powering 1M+ Apps

A series of critical vulnerabilities in the widely used open-source LLMOps platform Dify, which powers over one million AI applications.

These vulnerabilities, collectively referred to as “DifyTap,” include four flaws, two rated as critical and two that require no authentication. They expose cross-tenant data leakage risks, allowing attackers to access private AI conversations , preview sensitive documents, and interact with internal APIs.

This issue particularly affects Dify’s multi-tenant cloud environment, where failures in tenant isolation allow one customer to access another tenant’s data.

Dify has seen significant adoption among enterprises such as Volvo, Maersk, Panasonic, and Thermo Fisher, boasting over 140,000 stars on GitHub and more than 10 million Docker pulls.

The platform’s architecture supports low-code AI application development with integrated plugins, retrieval-augmented generation pipelines, and tracing capabilities. However, Zafran’s research reveals that fundamental design assumptions regarding tenant isolation and API trust boundaries can be circumvented.

One of the most critical issues, tracked as CVE-2026-41947, has a CVSS score of 9.1 and affects Dify’s tracing functionality. This feature allows developers to configure external tracing providers to capture application telemetry, including prompts and model responses.

Researchers discovered that the tracing endpoints do not validate tenant ownership. Consequently, an attacker with a standard user account can obtain an application ID from publicly accessible apps and set up malicious tracing, creating a persistent exfiltration channel for all future conversations. This enables silent interception of sensitive prompts and responses without the user’s awareness.

Another critical vulnerability, CVE-2026-41948, has a CVSS score of 9.4 and affects the Plugin Daemon service, which executes plugins. This flaw results from the unsafe handling of user-controlled input in internal API requests.

While current exploitation is limited to endpoints such as debug profiling interfaces, this architectural weakness poses a significant risk as new endpoints may be added in the future.

Two additional vulnerabilities, CVE-2026-41949 and CVE-2026-41950, affect Dify’s file-handling mechanisms. Researchers have demonstrated that file access controls depend indirectly on message-level permissions, allowing bypass through direct UUID references.

In one instance, attackers can preview documents uploaded by other tenants without authorization. In another case, they can attach an existing file UUID to a chatbot interaction and prompt the model to reveal its contents, creating a clear path for data exfiltration both within and across tenants.

Zafran also identified prolonged exposure to CVE-2024-5846, a use-after-free vulnerability in PDFium within Dify’s file parsing stack. The vulnerable version remained in use for over 18 months, enabling attackers to potentially execute code by uploading malicious PDF files processed through the preview functionality.

All vulnerabilities were disclosed responsibly, and patches have been released in Dify version 1.14.2, with an additional fix pending release.

Security teams are advised to update immediately and implement compensating controls, such as web application firewall rules, to detect attempts to traverse paths. Zafran has also released Snort signatures to help identify exploitation activity targeting Plugin Daemon endpoints.

These findings underscore a broader issue in AI platform security, especially concerning microservices-based architectures, where application-level vulnerabilities may evade traditional container scanning tools.

Zafran recommends enhanced visibility techniques, including its “shadow container image component enrichment,” to more accurately map application-level risks.

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

A pervasive CI/CD vulnerability pattern dubbed “Cordyceps” reveals a supply chain vulnerability that lets unauthenticated…

A security incident involving the third-party platform Klue has resulted in unauthorized access to limited…

The Five Eyes cyber security agencies have issued a joint warning that artificial intelligence is…

A sophisticated campaign by the actor tracked as “Dropping Elephant” that uses a China-themed decoy…

A large-scale analysis of smart TV applications has revealed that thousands of apps available on…

ANY.RUN today launched in-browser data inspection for its Interactive Sandbox, a capability that brings real…