CVE-2026-41947: DifyTap: Four Authorization Flaws in Dify Enable Cross-Tenant AI Data Exfiltration
CVE-2026-41947 is a critical-severity security issue (CVSS 9.1) in Dify, an AI agent. Affected: <1.14.2. Fixed in 1.14.2.
Is Dify running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-41947- Severity
- critical
- CVSS score
- 9.1
- Attack type
- Other
- Component
- Dify · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-41947?
Zafran Security disclosed four vulnerabilities in the Dify open-source LLMOps platform (which powers 1M+ AI apps): CVE-2026-41947 (CVSS 9.1, cross-tenant trace-config bypass), CVE-2026-41948 (CVSS 9.4, plugin-daemon path traversal), CVE-2026-41949 and CVE-2026-41950 (cross-tenant/in-tenant file reads). Several require no authentication and let attackers "wiretap" AI chat data across tenants. All except CVE-2026-41948 are fixed in Dify 1.14.2; the path-traversal fix is pending the next release.
Affected versions
| Affected | Fixed in |
|---|---|
<1.14.2 | 1.14.2 |
Am I affected by CVE-2026-41947?
You are affected if you run Dify <1.14.2. Versions 1.14.2 and later include the fix.
How do I fix CVE-2026-41947?
Upgrade Dify to 1.14.2+ and watch for the release that closes CVE-2026-41948. Restrict network access to Dify management/internal (plugin-daemon) services, enforce authentication on all endpoints, and audit cross-tenant file/trace access for the disclosure window.
How do I find every machine running Dify?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Dify and which version, then enforce a policy on it.