Dify Path Traversal Vulnerability (CVE-2026-41948)

hello@craftedsignal.io — Mon, 18 May 2026 15:17:16 +0000

Dify, a platform for building AI applications, is vulnerable to a path traversal flaw affecting version 1.14.1 and earlier. This vulnerability, identified as CVE-2026-41948, allows authenticated users to manipulate requests forwarded to the Plugin Daemon’s internal REST API. Attackers can exploit insufficient URL path sanitization to traverse out of their authorized tenant path using unencoded dot sequences (../) in task identifiers or manipulated filename parameters. This enables access to internal endpoints, including debug interfaces. Notably, Dify Cloud’s free self-registration feature lowers the barrier to entry, as attackers can trivially create accounts to probe and exploit the vulnerability, only requiring knowledge of the victim tenant’s UUID. This could lead to sensitive information disclosure or unauthorized modifications within the Dify environment.

Attack Chain

Attacker registers a free account on Dify Cloud.
Attacker identifies the UUID of a target tenant within Dify Cloud.
Attacker crafts a malicious request to the Plugin Daemon’s internal REST API, embedding a path traversal sequence (e.g., ../) in a task identifier or filename parameter.
The crafted request bypasses URL path sanitization due to insufficient validation of dot sequences.
The request is forwarded to an internal endpoint outside of the attacker’s authorized tenant path.
The attacker gains access to internal endpoints, such as debug interfaces.
Attacker leverages access to internal endpoints to gather sensitive information about the target tenant or the Dify Cloud infrastructure.
Attacker escalates privileges or performs unauthorized actions based on the gained information.

Impact

Successful exploitation of CVE-2026-41948 allows attackers to bypass tenant isolation within Dify environments. This can lead to the disclosure of sensitive information, such as API keys, internal configurations, or user data, from other tenants. The vulnerability could also allow attackers to perform unauthorized actions, such as modifying configurations or deploying malicious plugins, potentially impacting multiple users of the platform. Given that Dify Cloud offers free self-registration, the barrier to entry for exploitation is low, increasing the potential scope of impact.

Recommendation

Upgrade Dify to a version patched against CVE-2026-41948 to remediate the path traversal vulnerability.
Implement robust input validation and sanitization on URL paths within the Plugin Daemon’s internal REST API to prevent path traversal attacks.
Monitor web server logs for suspicious requests containing path traversal sequences (e.g., ../) in URLs targeting the Plugin Daemon’s API, using the provided Sigma rule.
Review and restrict access to internal endpoints to minimize the potential impact of unauthorized access.
Implement strict tenant isolation policies and regularly audit access controls to prevent cross-tenant access.

Dify Authorization Bypass Vulnerability (CVE-2026-41947)

hello@craftedsignal.io — Mon, 18 May 2026 15:17:04 +0000

Dify, a platform for building AI-native applications, is vulnerable to an authorization bypass (CVE-2026-41947) affecting version 1.14.1 and prior. Authenticated users with editor privileges can exploit this vulnerability to manipulate trace configurations across different tenants. The vulnerability stems from a lack of tenant ownership verification when setting and enabling trace configurations. A successful exploit allows an attacker to redirect messages and responses from victim applications to attacker-controlled LLM trace providers, effectively intercepting and potentially exfiltrating sensitive data processed by the targeted applications. The Dify Cloud offering allows unauthenticated free self-registration, lowering the barrier to entry for attackers.

Attack Chain

Attacker registers an account on Dify Cloud (if using Dify Cloud) or gains editor privileges on a Dify instance.
Attacker authenticates to the Dify platform using their account credentials.
Attacker identifies the target application they wish to monitor by enumerating available applications or through other means.
Attacker crafts a malicious API request to set the trace configuration for the target application. The request specifies an attacker-controlled LLM trace provider endpoint.
The trace configuration endpoint lacks proper tenant ownership checks, allowing the attacker to modify the configuration of the target application.
Attacker enables the trace configuration for the target application.
All subsequent messages and responses from the victim application are redirected to the attacker-controlled LLM trace provider.
Attacker intercepts and analyzes the redirected messages to extract sensitive information.

Impact

Successful exploitation of CVE-2026-41947 can lead to unauthorized access to sensitive information processed by Dify applications. An attacker can intercept application messages and responses, potentially exposing confidential data, intellectual property, or personally identifiable information (PII). The severity of the impact depends on the nature of the data handled by the compromised applications, but the vulnerability could affect all Dify users.

Recommendation

Apply the necessary patches or upgrade to a version of Dify beyond 1.14.1 to remediate CVE-2026-41947.
Implement the “Detect Dify Unauthorized Trace Configuration Change” Sigma rule to identify potential exploitation attempts.
Implement the “Detect Dify Trace Configuration Creation to External Host” Sigma rule to identify creation of traces that lead to external endpoints.
Review and restrict editor privileges to only those users who require them, minimizing the attack surface.

Dify Cloud — CraftedSignal Threat Feed

Dify Path Traversal Vulnerability (CVE-2026-41948)

Attack Chain

Impact

Recommendation

Dify Authorization Bypass Vulnerability (CVE-2026-41947)

Attack Chain

Impact

Recommendation