DifyTap: Four Bugs Put over 1 million AI Apps at Risk
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-5846 | Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium) NVD description · AI analysis pending | 8.8 | <1% |
| — | ||
| CVE-2026-41948 | Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's int Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker. NVD description · AI analysis pending | 9.3 group max | 7% | PoC |
| — | |
| CVE-2026-41950 | Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other u Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit insufficient permission verification in the chat-messages endpoints to access files without ownership validation, bypassing workspace separation and signed URL protections to retrieve sensitive file contents through workflow processing. NVD description · AI analysis pending | 6.0 | <1% | PoC |
| — |
Full article622 words · extracted from securityaffairs.com · click to collapse
Four flaws in Dify exposed cross-tenant data, documents and AI conversations. Two critical bugs enabled unauthenticated access and data theft.
Zafran Labs researchers disclosed four vulnerabilities in Dify, the open-source AI platform used by major companies like Volvo and Maersk to run over a million applications across over 60 industries. Two vulnerabilities are of critical severity, two require no authentication at all, and three carry cross-tenant impact on Dify’s cloud service, meaning one customer’s private data was readable by another. The researchers collectively named the set of flaws DifyTap.
The first and most severe flaw is CVE-2026-41947 (CVSS score of 9.1), which lives in Dify’s tracing system, the component that logs messages and model responses for monitoring and analytics.
“An attacker can configure their own tracing for any application they can access as a client, which includes all publicly accessible applications.” reads the advisory. “This allows an attacker to create a persistent exfiltration channel for all messages and responses sent in the application.”
Getting a Dify console account to pull this off requires nothing more than signing up for the platform. That’s not a high bar.
The second critical flaw, tracked as CVE-2026-41948 (CVSS score of 9.4), resides in the Plugin Daemon, the internal service that runs Dify’s plugin system.
“We discovered two primitives that allow access to arbitrary endpoints within the Plugin Daemon: one via GET and one via POST.” continues the report.
The GET primitive works by injecting a path traversal into the filename parameter of a plugin icon request, which gets passed directly into an internal API URL with no sanitization. Worse, the endpoint requires no login whatsoever, so anyone with network access to the Dify instance can exploit it. The POST primitive has a similar anatomy, just in the task deletion endpoint.
The remaining two flaws, tracked as CVE-2026-41949 and CVE-2026-41950, both involve file access. The preview endpoint for uploaded documents checks that a file is of type “Document,” and nothing else. No ownership check, no tenant check. Any console user can preview any document in the entire system. The second flaw lets a client attach another user’s file UUID to their own chat message, then prompt a file-capable chatbot to read it back. Ask the AI to repeat the contents of the file exactly. It will.
Zafran also found that Dify ran a PDFium binary vulnerable to CVE-2024-5846, a use-after-free bug publicly disclosed in June 2024, for more than a year and a half, until December 21, 2025. Any end user could trigger it by uploading a malicious PDF to the preview endpoint.
“On a wider scale, many AI applications face the same danger. Those applications support parsing of many file formats from untrusted sources, allowing any end user to attempt and trigger known vulnerabilities in programs such as PDFium, ffmpeg or others.” continues the report. “Besides bumping versions regularly, applications should also sandbox these kinds of operations.”
This is a category problem, not just a Dify problem.
The research also surfaced a blind spot in container security scanning. Dify copies unpackaged Python code directly into its container images, which means standard scanners don’t detect the application itself as a component and never surface its vulnerabilities. Zafran developed what they call “shadow container image component enrichment” to infer what application a container image represents and match it against project-level CVEs. Without something like that, Dify’s vulnerabilities would have been invisible to every automated scanner watching the environment.
Dify version 1.14.2 addresses the above vulnerabilities.
“For those currently operating on version 1.14.2, it is highly recommended to implement Web Application Firewall (WAF) rules specifically designed to mitigate CVE-2026-41948.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, DifyTap)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/194081/hacking/difytap-four-bugs-put-over-1-million-ai-apps-at-risk.html