Researchers Detail Dify Tap Flaws in Dify That Could Expose AI Chats Across Tenants
Summary: Zafran Security disclosed four vulnerabilities in Dify, an open-source agentic workflow platform with more than 146,000 GitHub stars, collectively codenamed DifyTap; two were critical severity, two required no authentication, and three carried cross-tenant impact on Dify's multi-tenant cloud service. The flaws could let attackers read private AI chats from other customers' applications, redirect messages and responses to an attacker-controlled LLM trace provider, traverse the internal Plugin Daemon API, and preview or leak other tenants' files, and Dify's file parsing stack also relied on a PDFium version vulnerable to CVE-2024-5846 (CVSS 8.8).
Key Takeaway: Anyone can freely register for a Dify account, so an attacker can configure their own tracing for any application they can access as a client, including all publicly accessible ones, and turn it into a persistent exfiltration channel for every message and model response. All vulnerabilities except CVE-2026-41948 were fixed in version 1.14.2, leaving one flaw without a patch until the next release.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-5846CVE-2026-41948
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026