Vulnerabilities · 83 days ago

Dify’s tenant boundary leaks chats and files

Dify’s real problem is not one bad endpoint. It is a broken trust boundary in a multi-tenant AI platform, where user-supplied IDs and forwarded internal requests can make another customer’s chats, uploaded files, and trace data look local. Three flaws are fixed in 1.14.2, but one disclosed CVE remains open, so patching does not fully close the leak.

Zafran’s DifyTap set covers four vulnerabilities in Dify. Two were unauthenticated, three had cross-tenant impact, and the affected paths include chat content, file preview, and internal plugin API calls; one issue also affects PDFium via CVE-2024-5846. The practical risk is that tenant data can cross into places scanners and basic patch checks may not prove clean, especially in deployments with shared AI chat, file, or trace features.

CVE-2026-41948

NVD KEV

CVSS 9.4 CRITICAL: dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate… EPSS 7% (94th percentile).

CVE-2026-41947

NVD KEV

CVSS 9.1 CRITICAL: dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to… EPSS 6% (93rd percentile), up from 0.5%.

CVE-2026-41949

NVD KEV

CVSS 5.9 MEDIUM: dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows… EPSS 0.4% (35th percentile).

CVE-2026-41950

NVD KEV

CVSS 6.5 MEDIUM: dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the… EPSS 0.3% (27th percentile).

Timeline

Sources

3 sources covering this story

SecurityWeek Jun 23
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps
Attackers could abuse Dify's multi-tenant cloud service to read private chats, preview other tenants' documents, and reach internal APIs.
The Hacker News Jun 22
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants
Four DifyTap flaws could expose private AI chats and files across Dify tenants; three are fixed in version 1.14.2.
Dark Reading Jun 22
DifyTap Bugs Let Attackers 'Wiretap' AI Chat Histories
Four vulnerabilities allow attackers to exploit Dify, a platform for AI application building and management, to silently access sensitive data.

Entities

CVE-2026-41947
CVE-2026-41948
CVE-2026-41949
CVE-2026-41950

Part of the PlainSec briefing for 2026-06-24

Editions

Vulnerabilities · 83 days agoDify’s tenant boundary leaks chats and filesDify’s real problem is not one bad endpoint. It is a broken trust boundary in a multi-tenant AI platform, where user-supplied IDs and forwarded internal requests can make another customer’s chats, uploaded files, and trace data look local. Three flaws are fixed in 1.14.2, but one disclosed CVE remains open, so patching does not fully close the leak.Zafran’s DifyTap set covers four vulnerabilities in Dify. Two were unauthenticated, three had cross-tenant impact, and the affected paths include chat content, file preview, and internal plugin API calls; one issue also affects PDFium via CVE-2024-5846. The practical risk is that tenant data can cross into places scanners and basic patch checks may not prove clean, especially in deployments with shared AI chat, file, or trace features.

CVE-2026-41948

NVD KEV

CVSS 9.4 CRITICAL: dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate… EPSS 7% (94th percentile).

CVE-2026-41947

NVD KEV

CVSS 9.1 CRITICAL: dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to… EPSS 6% (93rd percentile), up from 0.5%.

CVE-2026-41949

NVD KEV

CVSS 5.9 MEDIUM: dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows… EPSS 0.4% (35th percentile).

CVE-2026-41950

NVD KEV

CVSS 6.5 MEDIUM: dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the… EPSS 0.3% (27th percentile).