Executive Summary: Multitenancy Boundary Collapse in AI Workflows

Security researchers have disclosed a maximum-gravity vulnerability in Dify, the premier open-source and enterprise LLM application development platform utilized by tens of thousands of engineering organizations, financial institutions, and autonomous agent developers worldwide. Tracked as CVE-2026-41948 with a CVSS v3.1 base score of 9.4 (Critical), the flaw enables unauthenticated remote adversaries to bypass workspace tenancy boundaries and issue arbitrary requests to the backend Plugin Daemon.

Dubbed "DifyTap" by discovery teams, the vulnerability compromises the foundational multi-tenant isolation model of enterprise Dify deployments. By breaking out of workspace-scoped path constraints, threat actors can manipulate plugin execution environments, extract proprietary system configuration secrets, harvest enterprise API keys, and exfiltrate conversations and fine-tuning datasets belonging to unrelated corporate tenants sharing the same infrastructure cluster.

Vulnerability Mechanics & Path Traversal (CWE-22) in Plugin Daemon

Dify separates its primary application orchestration engine from its third-party tool and model execution layer using a dedicated microservice called the Plugin Daemon. Communication between the user-facing web API and the internal Plugin Daemon is managed via HTTP forwarding proxies implemented in api/core/plugin/impl/base.py.

When a client requests a plugin asset (such as an icon or manifest) via endpoints like /console/api/workspaces/current/plugin/icon, the application constructs the upstream request using the BasePluginClient._prepare_request method: 

# Vulnerable path concatenation in api/core/plugin/impl/base.py (prior to v1.15.0)
def _prepare_request(self, tenant_id: str, path: str):
    # Intent: Scope all requests to the tenant's dedicated asset prefix
    base_endpoint = f"plugin/{tenant_id}/asset/"
    # Vulnerability: 'path' was concatenated directly without directory traversal normalization
    upstream_url = urllib.parse.urljoin(self.daemon_url, base_endpoint + path)
    return upstream_url

Because the method failed to validate or reject dot-dot-slash (../ or %2e%2e%2f) sequences within the incoming path variable:

  1. An attacker supplies a crafted path containing multiple directory traversal segments: ../../../../api/v1/system/plugins.
  2. The internal HTTP client normalizes the URL against the base daemon address, stripping away the plugin/{tenant_id}/asset/ prefix entirely.
  3. The request lands directly on privileged internal administrative routes on the Plugin Daemon (such as endpoints for managing global plugins, inspecting server health metrics, and reading runtime credentials) that were never intended to be exposed to external users.

Cross-Tenant Threat Telemetry & Exploitation Blast Radius

In multi-tenant SaaS environments or shared corporate Dify instances where self-registration is enabled, an unauthenticated attacker can create an ephemeral guest workspace and immediately exploit the traversal to target peer organizations:

Target Internal API Endpoint Attacker Capability Blast Radius
/api/v1/tenants/{target_tenant}/keys Extract OpenAI, Anthropic, and AWS Bedrock API keys Total credential theft & bill-hijacking
/api/v1/plugins/installed Inspect all enterprise tools, database connectors, and internal URLs Internal network reconnaissance & credential discovery
/api/v1/runtime/environment Dump container environment variables, secret keys, and DB passwords Full host cluster and database compromise

Remediation & Patch Verification

The Dify maintainers resolved the issue in version 1.15.0 by introducing strict path validation logic in BasePluginClient._prepare_request that explicitly rejects directory traversal tokens before assembling the upstream HTTP request: 

# Patched implementation in Dify v1.15.0
decoded_path = urllib.parse.unquote(path)
if ".." in decoded_path or decoded_path.startswith("/"):
    raise ValueError("Invalid path: directory traversal characters detected")

Engineering & Operations Checklist

  1. Upgrade Dify Containers: Enterprise administrators must update their deployment manifests to pull Dify version 1.15.0 or later: 
    # Update docker-compose.yaml image tags:
langgenius/dify-api:1.15.0
langgenius/dify-plugin-daemon:1.15.0

# Deploy updated containers
docker compose down && docker compose pull && docker compose up -d
  2. Apply Enterprise Hotfix: For organizations running enterprise distributions unable to perform a full minor-version upgrade, deploy the dedicated hotfix image: 
    docker pull langgenius/dify-ee-api:3.9.5-hotfix-20260609
  3. Network Segmentation for Plugin Daemons: Enforce strict firewall rules ensuring the Plugin Daemon port (default 5003) is strictly accessible via authenticated internal service meshes and completely inaccessible from external perimeter routers.