DifyTap Path Traversal Lets Attackers Peek Into Other Tenants' AI Chats
A path‑traversal bug (CVE‑2026‑41948) in Dify 1.14.1 and earlier lets authenticated users bypass tenant isolation and send crafted requests to the Plugin Daemon’s internal API, exposing other customers’ AI conversation data. Because Dify Cloud permits free self‑registration, attackers can easily acquire a tenant ID and read cross‑tenant chats until a fix lands in version 1.14.2.