Four newly disclosed vulnerabilities in Dify, the open-source LLMOps platform powering over one million AI applications, have exposed serious architectural weaknesses that can leak private AI conversations and sensitive documents across enterprise tenants.
Collectively dubbed DifyTap by researchers at Zafran Security, the flaws affect a platform trusted by major enterprises including Volvo, Maersk, Panasonic, and Thermo Fisher.
With more than 140,000 GitHub stars, over 10 million Docker pulls of its API image, and deployments across 60-plus industries, Dify consistently ranks among the most widely adopted AI infrastructure platforms.
Critical DifyTap Vulnerability
During the investigation, researchers also identified tens of thousands of internet-facing Dify instances, underscoring the breadth of potential exposure.
The vulnerabilities collectively expose a range of attack vectors:
- CVE-2026-41947 (CVSS 9.1): Tracing configuration endpoints fail to validate the requesting user’s tenant. An attacker with a free Dify cloud account can configure their own tracing provider on any publicly accessible application, creating a persistent exfiltration channel for all messages and model responses; no authentication beyond basic signup is required.
- CVE-2026-41948 (CVSS 9.4): A path traversal flaw in the plugin icon endpoint allows unauthenticated traversal into Dify’s internal Plugin Daemon API. The
filenamequery parameter is injected directly into an internal URL without sanitization. A companion POST primitive similarly exploits the task deletion endpoint. - CVE-2026-41949: Dify’s document preview endpoint (
/console/files/<FILE_ID>/preview) performs no permission checks on the supplied UUID, allowing any console user, trivially obtained via free cloud registration, to read the first 3,000 characters of any document in the system, including those belonging to other tenants. - CVE-2026-41950: When a client sends a message with an attached file UUID, Dify only validates the Tenant ID, not file ownership. An attacker can attach another user’s file UUID to their own message and prompt an LLM with file-reading capabilities to return its contents verbatim.
Beyond the logic vulnerabilities, Zafran found that Dify’s file parsing pipeline ran a version of pypdfium2 vulnerable to CVE-2024-5846, a use-after-free flaw in Chromium’s PDFium binary, for over 18 months after its public disclosure in June 2024.
Dify has released version 1.14.2, patching CVE-2026-41947, CVE-2026-41949, and CVE-2026-41950. A fix for CVE-2026-41948 has been merged into the GitHub repository.
Organizations running 1.14.2 are advised to deploy WAF rules in the interim. Published Snort signatures to detect and block path traversal attempts via both GET and POST request patterns targeting the plugin icon and task deletion endpoints.
Zafran researchers noted that traditional container scanners routinely miss application-level CVEs when images use complex build patterns such as Dify’s approach of copying unpackaged Python code directly into the container.
Addressed this with a new “shadow container image component enrichment” capability that infers the underlying application from a container image and maps it against project-level CVEs, surfacing risks previously invisible to security teams.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
