Security researchers have disclosed a set of vulnerabilities in Dify, a popular open-source AI application platform, that could allow attackers to access private AI conversations, uploaded documents, and internal plugin services.
The flaws, collectively referred to as DifyTap, were discovered by researchers at Zafran. Dify is widely used as an orchestration layer for building, deploying, and managing AI applications without requiring organizations to build the full infrastructure themselves.
That popularity makes the findings especially important. Dify has more than 10 million pulls of its API image on Docker, and researchers identified tens of thousands of Internet-facing Dify instances.
For organizations using Dify to power customer-facing chatbots, internal copilots, document assistants, or AI workflows, the vulnerabilities highlight a growing reality: AI platforms now sit close to some of the most sensitive enterprise data.
What Is DifyTap?
DifyTap is the name given to four vulnerabilities affecting Dify.
The flaws include:
- CVE-2026-41947 — tracing configuration flaw, CVSS 9.1
- CVE-2026-41948 — Plugin Daemon path traversal flaw, CVSS 9.4
- CVE-2026-41949 — unauthorized document preview issue, CVSS 6.5
- CVE-2026-41950 — cross-file user access flaw, CVSS 6.5
Together, these vulnerabilities could allow attackers to:
- leak private AI chat histories
- capture user prompts and model responses
- register attacker-controlled tracing backends
- access exposed internal Plugin Daemon APIs
- preview documents uploaded by other tenants
- leak files across users within the same tenant
- exploit weak authorization around document UUIDs
Zafran said it is not aware of real-world exploitation attempts at the time of reporting, but the risk is significant enough that affected organizations should patch quickly.
Why AI Chat Histories Are Sensitive
AI chat histories are not just ordinary logs.
Users often paste sensitive information into AI applications, including:
- customer data
- internal documents
- source code
- contracts
- credentials
- business plans
- legal content
- financial details
- support cases
- personal data
- confidential prompts and responses
If attackers can intercept AI conversations, they may gain access to data that was never meant to leave the organization.
That makes AI platforms high-value targets.
The more useful an AI application becomes, the more sensitive the data flowing through it usually is.
CVE-2026-41947: Tracing Hijack and AI Wiretapping
The most attention-grabbing flaw is CVE-2026-41947, a tracing configuration vulnerability with a CVSS score of 9.1.
In AI systems, tracing is used to monitor and profile application behavior. It can capture prompts, model responses, execution flows, latency, errors, and other operational telemetry.
That data is useful for debugging and observability, but it is also highly sensitive.
According to Zafran, an attacker could create a Dify account, identify a public-facing application, obtain the application’s internal App ID, call Dify’s tracing configuration API, and register their own tracing backend.
Once that happens, the attacker could establish a persistent exfiltration channel for messages and responses sent through the application.
In practical terms, this is similar to wiretapping an AI chatbot.
For a company using Dify for customer support, this could expose user prompts, model responses, private chat histories, and potentially sensitive customer data.
CVE-2026-41948: Plugin Daemon Path Traversal
The second high-severity issue is CVE-2026-41948, a Plugin Daemon path traversal vulnerability with a CVSS score of 9.4.
Dify’s Plugin Daemon is responsible for managing and running plugins.
The vulnerability could allow attackers to reach exposed parts of the internal Plugin Daemon API from unauthenticated requests.
Zafran noted that the immediate impact is currently limited, mainly involving access to debug and performance profiling data. However, the architectural risk is more serious.
If an internal service can be reached improperly, any future endpoint added to that service could become a high-impact vulnerability.
That makes this flaw important beyond its immediate impact. It exposes a boundary weakness in the platform architecture.
CVE-2026-41949: Unauthorized Document Preview
CVE-2026-41949 affects document preview access.
Dify applications may allow users to upload documents such as PDFs, text files, reports, or knowledge-base material. These files are often tied to AI workflows and retrieval-augmented generation systems.
The vulnerability allows an attacker who obtains a document UUID to preview the document content through an endpoint without proper authorization checks.
A UUID should not be treated as a security control.
If knowing or guessing an identifier is enough to access content, the system has an authorization problem.
Documents uploaded to AI platforms may contain highly sensitive business or personal data, so preview endpoints must enforce strict access checks.
CVE-2026-41950: Cross-File User Access
CVE-2026-41950 is another document-related authorization flaw.
This issue could allow an attacker to get an AI application to leak file content by referencing a document UUID in a prompt, without additional authorization.
That creates a dangerous interaction between access control and AI behavior.
The attacker does not necessarily need direct file access in the traditional sense. They can use the AI application itself as the extraction mechanism.
This is especially concerning for multi-user or multi-tenant AI environments, where document boundaries must be enforced consistently across upload, preview, retrieval, prompting, and model response generation.
Patch Status
Zafran reported that three of the four vulnerabilities have been patched in Dify version 1.14.2:
- CVE-2026-41947
- CVE-2026-41949
- CVE-2026-41950
A fix for CVE-2026-41948 has been merged on GitHub.
Organizations that want to address all four flaws should build and deploy the most recent version from GitHub that includes the merged fix.
For organizations currently running Dify 1.14.2, Zafran recommends implementing Web Application Firewall rules specifically designed to mitigate CVE-2026-41948 until a fully released version is deployed.
Why Internet-Facing Dify Instances Are High Risk
Zafran identified tens of thousands of Internet-facing Dify instances.
That matters because exposed AI platforms can become attractive targets for attackers seeking sensitive data.
If an AI platform is reachable from the Internet and contains weak authorization controls, attackers may be able to probe it for:
- public apps
- exposed API endpoints
- document IDs
- plugin services
- tracing configuration
- tenant boundaries
- uploaded files
- chat histories
AI applications are often deployed quickly by teams focused on innovation and productivity. Security controls may lag behind deployment speed.
That creates risk.
AI Platforms Are Critical Enterprise Systems
The DifyTap vulnerabilities show why AI platforms should be treated as critical enterprise systems, not experimental side tools.
Many organizations are using AI platforms to process sensitive workflows, including:
- customer support
- internal knowledge search
- HR assistance
- legal document review
- engineering copilots
- sales support
- finance analysis
- compliance workflows
- document summarization
These systems may handle data from across the organization.
A vulnerability in the AI orchestration layer can therefore become a cross-domain data exposure issue.
Authorization Must Cover the Whole AI Workflow
Traditional application security focuses on endpoints, roles, sessions, and object permissions.
AI applications add new layers.
Authorization must be enforced across:
- chat sessions
- prompt histories
- model responses
- document uploads
- document previews
- retrieval pipelines
- vector stores
- plugin execution
- tracing and observability
- tenant boundaries
- internal service APIs
- agent tools and actions
If any one of these layers trusts only a UUID, frontend control, or weak internal assumption, sensitive data may leak.
The DifyTap issues show how AI workflows can expose data in unexpected ways.
What Organizations Should Do Now
Organizations running Dify should act quickly.
Recommended actions include:
- upgrade to Dify 1.14.2 or later
- deploy the latest GitHub version containing the CVE-2026-41948 fix
- apply WAF rules for CVE-2026-41948 if still on 1.14.2
- identify all Internet-facing Dify instances
- restrict public access where not required
- review tracing configuration for unauthorized backends
- audit uploaded document access
- inspect document preview logs
- check for unusual API calls
- review plugin daemon exposure
- enforce network restrictions around internal Dify services
- rotate secrets if compromise is suspected
- review tenant and user access boundaries
Any Dify instance exposed to the Internet should be prioritized for review.
What to Hunt For
Security teams should look for signs that DifyTap-style vulnerabilities may have been probed or abused.
Useful detection areas include:
- unexpected changes to tracing configuration
- unknown tracing backend URLs
- unusual App ID enumeration
- repeated access to document preview endpoints
- document UUID access from unexpected users
- suspicious prompts referencing file UUIDs
- unauthenticated requests to Plugin Daemon paths
- access to debug or pprof endpoints
- unusual outbound traffic from Dify services
- AI responses containing unexpected document content
- cross-tenant or cross-user file access anomalies
Because AI platforms often generate complex logs, organizations should ensure logging is centralized and retained long enough for investigation.
Lessons for AI Security
The DifyTap vulnerabilities highlight several broader lessons.
First, AI observability can become an exfiltration channel if tracing systems are not protected.
Second, document UUIDs are not access controls.
Third, internal plugin and daemon services must be isolated and authenticated.
Fourth, AI applications can leak data indirectly through prompts, retrieval, or model responses.
Fifth, Internet-facing AI platforms need the same hardening, monitoring, and patching discipline as any business-critical application.
AI does not reduce the need for traditional security controls. It expands where they must be applied.
Recommendations for CISOs
CISOs should treat AI platforms as part of the enterprise attack surface.
Practical steps include:
- inventory all AI platforms and apps
- classify what data each AI system can access
- require security review before Internet exposure
- apply least privilege to AI apps and plugins
- test tenant isolation and document access controls
- monitor tracing and observability integrations
- review vector stores and document retrieval permissions
- include AI platforms in vulnerability management
- require patch SLAs for AI infrastructure
- log AI application activity centrally
- perform regular penetration tests of AI workflows
The question should not be “Do we use AI?” but “Where is AI touching sensitive data, and how is that access controlled?”
Final Thoughts
DifyTap is a reminder that AI platforms can become powerful data exposure points when authorization, tracing, plugin access, and document permissions are not tightly controlled.
The most serious flaw could let attackers register their own tracing backend and capture private AI conversations. Other flaws could expose uploaded documents or internal plugin services.
Dify has patched most of the issues in version 1.14.2, and the remaining Plugin Daemon fix has been merged on GitHub.
Organizations using Dify should patch immediately, restrict exposure, review tracing settings, and audit document access.
AI platforms are no longer experimental side systems. They are becoming enterprise data hubs. That means they must be secured, monitored, and governed like critical infrastructure.
