- Critical vulnerabilities in the popular open-source AI platform Dify could have allowed attackers to secretly wiretap and steal AI chat conversations from other customers’ applications.
- Researchers collectively codenamed the flaws DifyTap, noting two were critical severity and several bypassed authentication, impacting Dify’s multi-tenant cloud service.
- The security defects, disclosed by Zafran Security researchers Ido Shani and Gal Zaban, could have created a covert channel to exfiltrate every user message and model response.
- Dify’s file parsing stack also relied on a vulnerable version of PDFium, exposing users to a two-year-old heap corruption bug via crafted PDF files.
Cybersecurity researchers have disclosed a suite of four serious vulnerabilities in the widely-used open-source AI platform Dify, uncovering a critical risk where attackers could stealthily read private AI conversations from other customers’ applications without authentication. The flaws, disclosed on June 22, 2026, by researchers from Zafran Security, were collectively codenamed DifyTap and impacted the platform with over 146,000 GitHub stars.
According to the researchers, two of the vulnerabilities were critical severity and three carried cross-tenant impact on Dify’s cloud service. Consequently, this could have allowed one customer’s sensitive AI data to be exposed to another. The issues enabled attackers to read private AI chats, creating a persistent exfiltration channel for every message.
Separately, Zafran discovered Dify’s file parsing relied on a version of PDFium vulnerable to CVE-2024-5846, a use-after-free bug. Meanwhile, the specific vulnerabilities included CVE-2026-41947, which let authenticated editors set trace configurations for any application.
Another flaw, CVE-2026-41948, was a path traversal issue allowing access to internal API endpoints. Researchers also identified CVE-2026-41949, which let users preview documents across tenants, and CVE-2026-41950, enabling file reads within the same tenant.
The researchers explained that missing tenant checks could redirect all victim application messages to an attacker-controlled trace provider. However, following responsible disclosure, fixes for most flaws were shipped in version 1.14.2 last month.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
