DifyTap Multi-Tenant Cross-Data Leak
What Happened
On June 22-23, 2026, researchers at Zafran Security disclosed "DifyTap"—four vulnerabilities (two critical, two lower-severity) in Dify, an open-source LLMOps platform used to run over 1 million applications. The most severe flaw, CVE-2026-41948 (CVSS 9.4), was a path traversal issue in the Plugin Daemon; its GET primitive required no login and accepted a user-supplied tenant ID, allowing unauthenticated traversal into Dify's internal APIs across tenant boundaries. A second critical flaw, CVE-2026-41947 (CVSS 9.1), affected the tracing endpoints, which failed to validate the requesting user's tenant: an authenticated console user—obtainable through free public registration—could enable trace configuration on any application whose ID they knew, creating a persistent "wiretapping" channel for all messages and model responses. Two further flaws, CVE-2026-41949 and CVE-2026-41950 (CVSS 6.5), permitted document preview and file access without ownership checks. Three of the four issues carried cross-tenant impact. Dify released version 1.14.2 addressing CVE-2026-41947, 41949 and 41950; the fix for CVE-2026-41948 was merged for a later release, with WAF rules recommended as interim mitigation.
How MEG 1 would have acted
The platform failed basic informational safety and isolation audits, systematically violating the privacy, cognitive integrity, and informational self-determination of over a million application users.
Source: Zafran Security research, June 2026; CVE records (NVD). Epistemic label: Grounded.
MEG 2 Analysis - Legal Framework
Agent level: N2 (management) - automated workflow orchestration and agent-building platform; manages critical corporate databases and user-chatbot interactions.
Cause (6.1):
(a) system defect - severe design defects in the tracing API and Plugin Daemon allowing cross-tenant data exposure and unauthenticated path traversal (security and isolation defect), attributable to the platform manufacturer (Dify). Note: authorization checks were absent or incorrectly scoped rather than merely weak; the free-registration model meant the authentication barrier provided no practical protection.
Attachment of liability: Dify as the platform manufacturer is fully liable for the design defects (6.1a) that compromised multi-tenant isolation and exposed private conversational data; operating organizations are exonerated if they upgraded to 1.14.2 and applied the recommended WAF rules for CVE-2026-41948 post-disclosure.
Procedural Mechanism
6.2 (architectural human confirmation): Modifying tracing configurations, accessing plugin daemons, or retrieving files must require strict, token-based architectural human confirmation. The platform must be technically blocked from processing unauthenticated data requests.
7.1 (independent forensics): Every API transaction, tracing modification, and file access request must be securely logged in an unalterable, independent ledger to prevent silent, unmonitored data exfiltration.
9.4 (least privilege): The platform's multi-tenant architecture lacked robust containerized isolation, allowing unauthenticated users to traverse directories, violating the principle of least necessary access.