DifyTap: Dify Flaws Exposed Other Tenants' AI Chats

Researchers at Zafran Security have disclosed four vulnerabilities in Dify, the open-source platform a lot of teams use to build AI workflows, that together would have allowed one customer to quietly read another customer's AI conversations. The cluster has been given a name: DifyTap.

Two of the four are rated critical. Two require no authentication at all. Three cross the tenant boundary on Dify's multi-tenant cloud, which is the part that should make anyone running a shared AI service pay attention.

Observability turned inside out

The most interesting flaw sits in the tracing configuration. Tracing is the bit of an AI platform that lets you watch prompts and responses flowing through your app for debugging and analytics. Useful, until you discover there's no ownership check on who can change where the traces get sent.

Because anyone can sign up for a Dify account, an attacker could point the trace provider for a publicly accessible application at infrastructure they control, then sit and collect every prompt and model response moving through it. A persistent exfiltration channel hiding inside a feature built for visibility.

The rest of the cluster

The other issues run in a similar spirit:

• Unauthenticated access to the internal Plugin Daemon API, which could be used to trigger cross-tenant calls.
• Document preview leaks, where an attacker could view files uploaded by other tenants.
• File pulls inside a tenant by referencing another user's file identifier.

Separately, Zafran noticed Dify was shipping with a version of PDFium still vulnerable to CVE-2024-5846, a use-after-free bug from 2024 that allows heap corruption through a crafted PDF. Old bug, new home.

What's patched, what isn't

Three of the four are fixed in Dify 1.14.2, released last month. CVE-2026-41948 is still open, with a fix expected in the next release. So a version check is the first move, and watching for the follow-up release is the second.

Dify has more than 146,000 stars on GitHub and sits inside a lot of corporate AI stacks. Quite often it's running in containerised deployments where conventional vulnerability scanners struggle to see exactly what version of what is actually live. Which means "we don't think we use Dify" and "we definitely don't use Dify" are two different sentences, and it's worth confirming which one applies.

The wider thing

The detail that's easy to miss in a write-up like this is how mundane the AI tooling layer has quietly become. Prompts contain customer data, internal documents, draft contracts, code, strategy notes. Model responses contain the answers built on top of all of that. Organisations are pouring sensitive material into these systems on the assumption that the boundaries between tenants, users and applications actually hold.

DifyTap is a reminder that those boundaries are only as strong as the youngest piece of code holding them up. The AI stack is now a credible route into the conversations and documents organisations assume are private, and the people probing it are getting more methodical about where to look.