A widely deployed open-source AI platform has been harboring a cluster of serious security flaws that collectively put more than a million AI-powered applications at risk of data exposure, unauthorized access, and persistent exfiltration. The vulnerability set, dubbed DifyTap, affects Dify — a platform used by major global enterprises across more than 60 industries to build, deploy, and manage AI applications at scale.
Security researchers identified four distinct vulnerabilities, two of which carry critical severity scores. What makes this disclosure particularly alarming is not just the technical severity of the individual bugs, but their combined blast radius: three of the four flaws impact Dify's cloud environment in a cross-tenant fashion, meaning one organization's private AI conversations, uploaded documents, and model outputs could be accessed by another customer entirely.
Breaking Down the Four Flaws
CVE-2026-41947 — Persistent Exfiltration via Tracing (CVSS 9.1)
The most insidious of the four flaws lives inside Dify's tracing subsystem — the component responsible for logging messages and model responses for monitoring and analytics purposes. An attacker who gains even minimal access to the platform, such as a standard user account obtained through normal registration, can configure their own tracing integration against any publicly accessible application. Once in place, that configuration functions as a persistent exfiltration channel: every message sent to the application and every model response generated flows silently to the attacker. The barrier to entry here is effectively zero — just a free account signup.
CVE-2026-41948 — Unauthenticated Plugin Daemon Access (CVSS 9.4)
The highest-scored vulnerability targets the Plugin Daemon, the internal service powering Dify's plugin ecosystem. Researchers uncovered two exploitation primitives — one via HTTP GET, one via POST — that together grant access to arbitrary internal endpoints within the daemon. The GET primitive exploits a path traversal flaw in the plugin icon filename parameter, which is passed unsanitized into an internal API URL. Critically, this endpoint requires no authentication whatsoever. Anyone with network access to a Dify instance can reach it. The POST primitive follows a similar pattern through the task deletion endpoint. Both represent textbook examples of insufficient input validation meeting insufficient access control.
CVE-2026-41949 & CVE-2026-41950 — Cross-Tenant File Access
The final two vulnerabilities both center on file handling. The document preview endpoint validates only that a file is of type "Document" — it performs no ownership verification and no tenant-boundary check. Any authenticated console user can therefore preview documents belonging to any other user in the system. The companion flaw allows a client-side user to attach another user's file UUID to their own chat session and instruct an AI assistant to read back the file contents verbatim. The AI complies without protest. Taken together, these two flaws turn Dify's document ecosystem into a self-service data exfiltration tool.
A Deeper Problem: Unpatched Dependencies and Container Blind Spots
Beyond the four core vulnerabilities, the investigation surfaced a troubling maintenance failure. Dify shipped a version of the PDFium binary affected by a known use-after-free vulnerability — publicly disclosed in mid-2024 — for well over a year before it was finally updated. Any end user could trigger the flaw simply by uploading a malicious PDF through the preview endpoint.
"Many AI applications face the same danger. Those applications support parsing of many file formats from untrusted sources, allowing any end user to attempt and trigger known vulnerabilities in programs such as PDFium, ffmpeg, or others."
This is a category-level risk, not an isolated vendor problem. As AI platforms increasingly ingest unstructured content from untrusted sources — PDFs, audio files, images, video — they inherit the full vulnerability surface of every underlying parser they invoke. Sandboxing these operations is not optional; it is a foundational security requirement that the broader AI application ecosystem has been slow to adopt.
Researchers also identified a structural gap in how container security scanning handles applications like Dify. Because Dify copies unpackaged Python source code directly into its container images, standard software composition analysis tools fail to register the application itself as a named component. Its vulnerabilities simply never surface in automated scans. A technique described as "shadow container image component enrichment" — which infers what application a container represents and maps it against known CVEs at the project level — was required to make these flaws visible at all. Without such an approach, Dify's entire vulnerability history would have remained invisible to every automated scanner in the environment.
What You Should Do
The DifyTap disclosure is a timely reminder that the AI application layer has not outgrown the security fundamentals that govern every other class of software. Authentication boundaries, input validation, dependency management, and sandboxing are not legacy concerns — they are as relevant to an LLM orchestration platform as they are to any enterprise web application. Organizations building critical workflows on AI infrastructure would do well to apply the same security rigor they demand from any other production system.
