PERMISSION/PROTOCOL
Back to incident tracker

2026-06-29

HighMedia report

Critical CVE-2026-41947 and CVE-2026-41948 in Dify Allow Unauthenticated Cross-Tenant Access to Private Conversations and Uploaded Files Across 1M+ Applications

CVE-2026-41947 and CVE-2026-41948 in Dify expose private chat histories and uploaded files across tenant boundaries in a platform powering 1M+ AI applications.

DifyCredential exposureCross-tenant authorization bypass / unauthenticated API accessDify SaaS platform / self-hosted Dify instances

What happened

Unauthenticated requests to Dify's internal API endpoints returned private conversation content and uploaded files belonging to tenants other than the requestor, bypassing multi-tenant isolation controls.

Why it matters

Private AI conversation histories and uploaded files exposed across tenant boundaries in a platform powering more than one million applications globally.

Missing authorization check

Every API request accessing tenant-scoped data should require a cryptographically-bound principal assertion verified before the query executes. Cross-tenant reads should be structurally impossible, not just blocked by application logic.

Would PP block it?

PP enforcement sits between the caller and the data access action. A request claiming to access one tenant's conversations while authenticated (or unauthenticated) as a different principal would generate a receipt mismatch and be blocked. Coverage is partial: PP cannot compensate for missing authentication at the platform's own ingress layer — that gap must be closed by the platform. PP covers the per-action authorization check; it does not replace platform-level tenant authentication.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-06-22

    DifyTap vulnerability set disclosed, including CVE-2026-41947 and CVE-2026-41948 alongside two additional flaws in the same advisory.

  2. 2026-06-29

    Check Point Threat Intelligence Report surfaces the Dify vulnerabilities, detailing cross-tenant data exposure and unauthenticated access vectors affecting the 1M+ application platform.

  3. 2026-07-01

    Secondary corroboration from secnews.gr citing CVE-2026-41947 and CVE-2026-41948 confirms the advisory details.

  4. 2026-07-02

    Kong Inc. publishes analysis framing the Dify flaws as part of a broader pattern of AI agent platform security failures. Dify releases version 1.14.2 patching all four vulnerabilities.

Technical breakdown

  • CVE-2026-41947 and CVE-2026-41948 (both critical severity) enabled access to other tenants' private conversation data through insufficient boundary enforcement in Dify's internal API layer.
  • The platform's multi-tenant isolation relied on application-layer controls that were bypassable without valid credentials, creating a gap between the assumed security model and actual enforcement.
  • A compounding SSRF vulnerability (CVE-2025-56520) widened the internal API attack surface reachable by an unauthenticated caller.
  • Conversation histories in AI agent platforms are high-value targets: they expose system prompts, agent instructions, user inputs, and uploaded documents — all potentially sensitive for enterprise deployments.
  • The open-source distribution model means any self-hosted Dify deployment that hadn't patched to v1.14.2 inherited the same exposure as the cloud SaaS version.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Data access gate, tenant-scoped API read endpoints
Still needs
Platform-level authentication enforcement at the API ingress layer; PP cannot substitute for absent session authentication in the host platform
Receipt required for
Reading conversation histories, accessing uploaded files, calling internal tenant-scoped API endpoints

PP's authorization primitive scopes every action receipt to a specific authenticated principal. A cross-tenant read attempting to access Tenant A's data while authenticated as Tenant B would fail to produce a valid receipt — blocking the unauthorized read at the enforcement layer.

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop