cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Dify Flaws Could Expose Data Across AI Application Tenants

· Original article ↗

Summary

Zafran Security reports four Dify vulnerabilities that could expose chats, files, and internal API access across tenants. Dify 1.14.2 includes fixes; users are advised to update and apply a WAF rule for CVE-2026-41948.

Key points

  • Zafran Security says four flaws could expose other tenants’ data in multi-tenant Dify deployments.
  • CVE-2026-41947 (CVSS 9.1) affects tracing endpoints that do not validate the sender’s tenant; exploitation requires a Dify console account.
  • CVE-2026-41948 (CVSS 9.4) affects the plugin daemon and could enable arbitrary API requests, path traversal, and impacts to other tenants’ environments.
  • CVE-2026-41949 and CVE-2026-41950 involve file identification and access permissions, potentially allowing cross-tenant previews or access to files belonging to other users on the same tenant.
  • Zafran says Dify’s PDF preview endpoint used a PDFium version vulnerable to CVE-2024-5846 until December 21, 2025.
  • Dify 1.14.2 includes patches; users are advised to update and apply WAF rules targeting CVE-2026-41948.

Article Details

Vulnerability Types
  • Cross-tenant data exposure and authorization flaws
  • Path traversal
  • Use-after-free
Severity
CVSS 9.1 and 9.4 for two vulnerabilities; the remaining two Dify flaws are described as high severity.
Affected Versions
  • Chromium PDFium 126.0.6462.0
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Implement WAF rules specifically designed to mitigate CVE-2026-41948.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article describes attackers exploiting Dify vulnerabilities through its tracing and plugin-daemon endpoints to access other tenants’ data and APIs.

CVE

CVE-2024-5846Fedoraproject · Fedora; Google · Chromeby the preview endpoint used Chromium PDFium binary version 126.0.6462.0, which was vulnerable to CVE-2024-5846, a use-after-free bug disclosed in June 2024.CVE-2026-41947Dify · DifyTracked as CVE-2026-41947 (CVSS score of 9.1), the first issue existed in Dify’s tracing functionality, which supports profiling and monitoring AI applications.CVE-2026-41948langgenius · difyThe second flaw, tracked as CVE-2026-41948 (CVSS score of 9.4), impacts the plugin daemon, which is responsible for managing and running Dify plugins.CVE-2026-41949Dify · DifyThe remaining two vulnerabilities, tracked as CVE-2026-41949 and CVE-2026-41950, are high-severity defects related to how file identification and access permissions are handled in Dify, allowing attackers to previewCVE-2026-41950Langgenius · DifyThe remaining two vulnerabilities, tracked as CVE-2026-41949 and CVE-2026-41950, are high-severity defects related to how file identification and access permissions are handled in Dify, allowing attackers to preview

Products

Chromium PDFiumand a half years, until December 21, 2025, the PDF parsing library used by the preview endpoint used Chromium PDFium binary version 126.0.6462.0, which was vulnerable to CVE-2024-5846, a use-after-free bug disclosed inDifyFour vulnerabilities in the open source AI platform Dify could be exploited to siphon other tenants’ data in multi-tenant cloud configurations, Zafran Security warns.

Related Articles