Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants

Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants Ravie LakshmananJun 22, 2026AI Security / Vulnerability Cybersecurity researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform with more than 146,000 GitHub stars, that could allow attackers to stealthily read artificial intelligence (AI) conversions from other customers' applications without requiring authentication. The vulnerabilities have been collectively codenamed DifyTap by Zafran Security. "Two were critical severity, two required no authentication, and three carried cross-tenant impact on Dify's multi-tenant cloud service, allowing one customer's data to be exposed to another," researchers Ido Shani and Gal Zaban said. The security defects could have allowed attackers to read private AI chats from other customers' applications, creating a covert exfiltration channel for every message and model response. They also made it possible to traverse Dify's internal Plugin Daemon API from unauthenticated requests and trigger cross-tenant internal API calls, as well as preview documents uploaded by other tenants and leak files across users within a tenant by attaching another user's file unique identifier. Separately, Zafran said it also discovered that Dify's file parsing stack relied on a version of PDFium, an open-source C++ library for PDF rendering, that was vulnerable to CVE-2024-5846 (CVSS score: 8.8), a two-year-old use-after-free bug that could allow a remote attacker to potentially exploit heap corruption via a crafted PDF file. The remaining vulnerabilities are listed below - CVE-2026-41947 (CVSS score: 9.1) - An authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. CVE-2026-41948 (CVSS score: 9.4) - A path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization and access internal, private endpoints. CVE-2026-41949 (CVSS score: 7.5/5.9) - An authorization bypass vulnerability in the file preview endpoint ("/console/api/files/{file_id}/preview") that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. CVE-2026-41950 (CVSS score: 6.5) - An authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. The missing tenant ownership checks can be exploited to redirect all messages and responses from victim applications to an attacker-controlled LLM trace provider. It's worth noting that anyone can freely register for a Dify account. "Consequently, an attacker can configure their own tracing for any application they can access as a client, which includes all publicly accessible applications," the researchers explained. "This allows an attacker to create a persistent exfiltration channel for all messages and responses sent in the application." Following responsible disclosure, all vulnerabilities barring CVE-2026-41948 have been addressed in version 1.14.2, which was shipped last month. A fix for the pending flaw is expected to be made available in the next release of Dify. "DifyTap demonstrates where the challenge lies in vulnerability visibility, particularly in container images, where differences between deployments can create visibility gaps that traditional scanners cannot detect," the company said. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  AI Security, Cloud security, data exfiltration, Path Traversal, Vulnerability ⚡ Top Stories This Week Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw ⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs Load More ▼ ⭐ Featured Resources [Watch Demo] See Which Security Gaps Attackers Could Exploit First AI Can’t Stop Every Attack. Learn How Zero Trust Can Block What’s Unknown Get the 2026 Guide to Govern and Secure Enterprise AI Agents at Scale Have You Outgrown Your MDR? 7 Warning Signs Every CISO Should Check