DifyTap Vulnerabilities Expose AI Chat Data Across Tenants in Open-Source Platform Dify

Cybersecurity researchers at Zafran Security have disclosed four vulnerabilities in Dify, an open-source agentic workflow platform with over 146,000 GitHub stars, collectively named DifyTap. These flaws could allow attackers to read AI conversations from other customers’ applications without authentication, creating a covert exfiltration channel for every message and model response.

Two of the vulnerabilities are critical severity, two require no authentication, and three carry cross-tenant impact on Dify’s multi-tenant cloud service. The defects enable attackers to traverse Dify’s internal Plugin Daemon API from unauthenticated requests, trigger cross-tenant internal API calls, preview documents uploaded by other tenants, and leak files across users within a tenant by attaching another user’s file unique identifier.

Additionally, Zafran discovered that Dify’s file parsing stack relied on a version of PDFium vulnerable to CVE-2024-5846 (CVSS 8.8), a use-after-free bug exploitable via crafted PDF files. The other vulnerabilities include CVE-2026-41947 (CVSS 9.1, authorization bypass for trace configurations), CVE-2026-41948 (CVSS 9.4, path traversal to Plugin Daemon API), CVE-2026-41949 (CVSS 7.5/5.9, file preview authorization bypass), and CVE-2026-41950 (CVSS 6.5, file content read within tenant).

Following responsible disclosure, all vulnerabilities except CVE-2026-41948 have been patched in Dify version 1.14.2. A fix for the remaining flaw is expected in the next release. Zafran Security highlighted that DifyTap demonstrates challenges in vulnerability visibility, particularly in container images where deployment differences create gaps traditional scanners cannot detect.