Dify Cross-Tenant Authorization Bypass via Trace Configuration Endpoints (DifyTap)

CVE-2026-41947 is an Insecure Direct Object Reference (IDOR) in Dify's trace configuration endpoints (/console/api/apps/<app_id>/trace-config). Versions prior to 1.14.2 accept authenticated requests to GET, POST, PATCH, or DELETE trace configurations for *any* app_id without verifying that the caller belongs to the same tenant as the target application. An attacker who obtains a victim app's app_id — trivially extracted from the JWT returned when accessing the app as a client — can bind their own LLM trace provider (LangSmith, Opik, Langfuse, etc.) to the victim app. From that moment on, every inbound prompt and outbound model response is silently copied to the attacker's observability backend. Dify ≤ 1.14.1 is affected; the fix landed in commit 55d05fe via PR #35793. The platform powers 1M+ deployed applications and is used by enterprises including Volvo, Maersk, Panasonic, and Thermo Fisher.

The vendor rates this CRITICAL 9.1 (CVSS 3.1) and 9.3 (CVSS 4.0), anchored on PR:N — no privileges required. That score is *defensible for Dify Cloud*, where unauthenticated free self-registration means anyone can create an editor account in seconds. But it overstates reality for self-hosted deployments, where the attacker must already hold an editor-role credential inside the instance. Even on Cloud, the impact is bounded to data confidentiality and trace-config integrity within Dify — there is no code execution, no lateral movement to infrastructure, and no supply-chain pivot. The CVSS vector's I:H captures the ability to overwrite trace configs, but it is not arbitrary write across the system. noisgate downgrades from CRITICAL to HIGH 8.2: the attack is devastatingly simple on Cloud but the blast radius is application-tier data exfiltration, not infrastructure compromise.

Sources.

1. Zafran Security — DifyTap Research Blog
2. The Hacker News — DifyTap Coverage
3. VulnCheck Advisory — Dify Trace Config Authorization Bypass
4. GitHub PR #35793 — Tenant-Scoping Fix
5. GitHub GHSA-48xc-wmw8-3jr3
6. Dify Release v1.14.2 — Security Fixes
7. CyberPress — DifyTap Cross-Tenant Flaws
8. Strix AI — CVE-2026-41947 Detail

Run this script on the host running Dify (or any machine with curl access to the Dify API). It checks the Dify instance version via the /console/api/setup or version endpoint. Usage: chmod +x check_cve_2026_41947.sh && ./check_cve_2026_41947.sh https://your-dify-instance.example.com. No authentication required for the version check.

#!/usr/bin/env bash
# check_cve_2026_41947.sh — Detect CVE-2026-41947 (Dify trace-config IDOR)
# Usage: ./check_cve_2026_41947.sh <DIFY_BASE_URL>
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <DIFY_BASE_URL>"
  echo "Example: $0 https://cloud.dify.ai"
  exit 2
fi

BASE_URL="${1%/}"
FIXED_MAJOR=1
FIXED_MINOR=14
FIXED_PATCH=2

# Try multiple version-discovery endpoints
VERSION=""
for endpoint in "/console/api/version" "/api/version" "/version"; do
  RESP=$(curl -sf --max-time 10 "${BASE_URL}${endpoint}" 2>/dev/null || true)
  if [[ -n "$RESP" ]]; then
    VERSION=$(echo "$RESP" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null || true)
    [[ -n "$VERSION" ]] && break
  fi
done

# Fallback: check HTML page for version string
if [[ -z "$VERSION" ]]; then
  RESP=$(curl -sf --max-time 10 "${BASE_URL}/" 2>/dev/null || true)
  VERSION=$(echo "$RESP" | grep -oP 'dify[/ ]v?\K[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null | head -1 || true)
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not determine Dify version at ${BASE_URL}"
  echo "Manual check: verify Dify version >= 1.14.2"
  exit 2
fi

echo "Detected Dify version: ${VERSION}"

IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}

if (( MAJOR > FIXED_MAJOR )) || \
   (( MAJOR == FIXED_MAJOR && MINOR > FIXED_MINOR )) || \
   (( MAJOR == FIXED_MAJOR && MINOR == FIXED_MINOR && PATCH >= FIXED_PATCH )); then
  echo "PATCHED — Dify ${VERSION} >= 1.14.2 (CVE-2026-41947 fixed)"
  exit 0
else
  echo "VULNERABLE — Dify ${VERSION} < 1.14.2 (CVE-2026-41947 applies)"
  echo "Action: Upgrade to Dify >= 1.14.2 and audit all app trace configurations."
  exit 1
fi