2026-06-23 · 2026-Q2
Dify "DifyTap" Cross-Tenant Data Exposure (CVE-2026-41947 to CVE-2026-41950)
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Dify (LangGenius) open-source LLM app platform, fixed in 1.14.2
Impact
Four flaws, two critical and two unauthenticated. The tracing subsystem can be redirected to an attacker endpoint to persistently exfiltrate all messages and responses from any accessible application (CVE-2026-41947); the Plugin Daemon allows unauthenticated access to arbitrary internal API endpoints via path traversal (CVE-2026-41948); console users and chatbots can read other organizations' documents and attached files (CVE-2026-41949, CVE-2026-41950)
Root cause
Missing tenant-identity validation and absent authentication on internal file and tracing endpoints; the platform also shipped a vulnerable PDFium binary for 18+ months, and container scanners missed the issues due to Dify's unpackaged code layout
CVEs
Sources
Catalog
Cite this: AgentProv incident record: Dify "DifyTap" Cross-Tenant Data Exposure (CVE-2026-41947 to CVE-2026-41950) (2026-06-23). https://agentprov.com/incidents/2026-06-23-dify-difytap-cross-tenant-data-exposure-cve-2026-41947-to-cve-2026-41950
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run