DifyTap: Four Authorization Flaws Let Attackers Silently Wiretap AI Chats Across Tenants on a Platform Powering Over 1 Million Apps
Zafran Security disclosed four authorization flaws in the open-source LLMOps platform Dify, including two critical bugs that let an attacker redirect another tenant's AI conversations to an attacker-controlled endpoint.
Overview
Security researchers at Zafran Security have disclosed four authorization vulnerabilities in Dify, the open-source LLMOps platform, that can let an attacker silently intercept the prompts and model responses flowing through applications built by other organizations. According to Zafran Security, which named the cluster of flaws DifyTap, two of the four bugs are rated critical and two require no authentication to exploit. Security Affairs reports that Dify is an open-source AI platform powering over one million applications across more than 60 industries.
The most serious of the four turns Dify’s own observability feature into a covert surveillance channel: by abusing a missing tenant-ownership check, an attacker can configure tracing on someone else’s application and have every message and response copied to an endpoint they control.
What We Know
Zafran disclosed the findings under the collective name DifyTap, as reported by SecurityWeek. The four vulnerabilities are CVE-2026-41947 (CVSS 9.1), CVE-2026-41948 (CVSS 9.4), CVE-2026-41949, and CVE-2026-41950, according to Security Affairs.
Dify is widely deployed. Cyber Security News reports that the platform underpins AI workflows, chatbots, and retrieval-augmented generation pipelines and has accumulated over 140,000 GitHub stars and 10 million Docker pulls. The same outlet lists Volvo, Maersk, Panasonic, and Thermo Fisher among its enterprise users.
The tracing flaw (CVE-2026-41947)
The headline vulnerability lives in Dify’s tracing system. According to the National Vulnerability Database, the flaw is an authorization bypass that “allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership,” letting attackers “redirect all messages and responses from victim applications to attacker-controlled LLM trace providers.” Zafran describes the same behavior, explaining that “an attacker can configure their own tracing for any application they can access as a client, which includes all publicly accessible applications,” allowing them to “create a persistent exfiltration channel for all messages and responses sent in the application,” according to Security Affairs.
The barrier to entry is low. The NVD entry notes that “Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker,” per the National Vulnerability Database.
The plugin daemon flaw (CVE-2026-41948)
The second critical bug, carrying the highest score of the set, sits in Dify’s Plugin Daemon. The National Vulnerability Database describes it as a path traversal vulnerability in “version 1.14.1 and prior” that “allows authenticated users to manipulate requests forwarded to the Plugin Daemon’s internal REST API by exploiting insufficient URL path sanitization.” Cyber Security News reports that the flaw can be exploited through crafted GET and POST requests to reach internal APIs without authentication.
The file-access flaws (CVE-2026-41949 and CVE-2026-41950)
The remaining two flaws break the boundaries between tenants’ files. According to Security Affairs, one vulnerability lets any console user preview any document in the system without ownership or tenant checks, while the other lets a client attach another user’s file UUID to a chat message and then prompt a file-capable chatbot to read and repeat the file’s contents. Zafran notes that the document-preview endpoint “takes a UUID and retrieves the first 3,000 characters,” according to Zafran Security. Cyber Security News summarizes the impact as the ability to preview documents uploaded by other tenants without authorization and to access files using only their UUIDs.
Patching
The fixes arrived in stages. Cyber Security News reports that version 1.14.2 addresses CVE-2026-41947, CVE-2026-41949, and CVE-2026-41950, while a fix for the plugin daemon flaw CVE-2026-41948 “has been merged and is expected in an upcoming release.” Zafran characterizes 1.14.2 as a partially patched version and states that all four CVEs are patched in version 1.15.0, according to Zafran Security. For deployments still on 1.14.2, Zafran recommends implementing Web Application Firewall rules specifically designed to mitigate CVE-2026-41948. Zafran says all findings were reported to Dify under responsible disclosure.
What We Don’t Know
Neither Zafran nor the outlets covering the disclosure report any confirmed in-the-wild exploitation of the DifyTap flaws. The published material describes the attack techniques and their preconditions rather than evidence that attackers have already used them. It is also not clear from the cited sources how many of the more than one million applications run on Dify’s multi-tenant cloud service — where unauthenticated self-registration makes the tracing attack trivial — versus self-hosted single-tenant deployments where the cross-tenant risk is reduced. The cited sources do not include a statement from Dify the company beyond the released patches.
Analysis
DifyTap is less a story about a single exotic bug than about a recurring failure mode in multi-tenant AI infrastructure: features built for legitimate operations becoming exfiltration channels when authorization checks are missing. Tracing exists so that developers can inspect what their models are doing; according to the National Vulnerability Database, the absence of a tenant-ownership check on the trace-configuration endpoints is what lets that same machinery be pointed at someone else’s traffic.
The data at stake is also distinctive. AI application logs are not ordinary access logs — they contain the full text of prompts and model responses, which in enterprise deployments routinely carry proprietary documents, customer records, and internal reasoning. Cyber Security News notes the platform is used for retrieval-augmented generation pipelines, the architecture that deliberately feeds private corpora into model context. A persistent, silent redirect of that traffic is closer to a wiretap than to a conventional data leak.
The disclosure lands amid a broader pattern The Machine Herald has tracked across the LLM tooling ecosystem, from authorization gaps in AI orchestration frameworks to credential exposure in agent pipelines. The DifyTap findings reinforce that as AI platforms consolidate around a handful of widely deployed open-source projects, a single missing tenant check can expose the conversations of a large slice of an industry at once.