Dify platform four critical vulnerabilities expose cross-tenant data
Researchers disclosed four vulnerabilities in the Dify open-source AI platform, including two critical flaws that required no authentication and enabled cross-tenant data exposure affecting over a million applications. The flaws allowed attackers to exfiltrate messages, access documents, and read chat histories across customer accounts without authorization.
What happened
Zafran Labs researchers disclosed four vulnerabilities in Dify, an open-source AI platform used by major companies including Volvo and Maersk to run over a million applications across over 60 industries. Two vulnerabilities are of critical severity and two require no authentication at all.
CVE-2026-41947 (CVSS 9.1) in Dify's tracing system allows attackers who sign up as console users to configure tracing for any publicly accessible application and create a persistent exfiltration channel for messages and responses. CVE-2026-41948 (CVSS 9.4) in the Plugin Daemon contains path traversal and endpoint access flaws that require no login and allow access to arbitrary endpoints within the service.
CVE-2026-41949 and CVE-2026-41950 involve file access without ownership or tenant checks, allowing any console user to preview any document in the system or attach another user's file UUID to chat messages for an AI to read back. Dify also ran a PDFium binary vulnerable to CVE-2024-5846, disclosed in June 2024, for more than a year and a half until December 21, 2025.
Reported impact
The vulnerabilities enable cross-tenant data exposure on Dify's cloud service, meaning one customer's private data was readable by another customer. Attackers can exfiltrate all messages and responses sent in applications and access documents and conversations without authorization.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.