Loading story…
Researchers disclosed four vulnerabilities in the open-source AI application platform Dify that could let attackers silently access sensitive customer data, including private AI chat histories and uploaded files. The issues, collectively named DifyTap by Zafran Security, affected tracing configuration, the internal Plugin Daemon API, document preview authorization, and cross-file user access. Two of the flaws were rated critical, and some attack paths were unauthenticated, creating cross-tenant exposure risks in Dify's multi-tenant cloud service.
The vulnerabilities could enable persistent interception and exfiltration of AI conversations, abuse of Dify's internal plugin services, preview of uploaded documents from other tenants, and access to files belonging to other users in the same tenant. Zafran said Dify is widely deployed, citing more than 10 million API image pulls and tens of thousands of internet-facing instances. Dify patched three issues in version 1.14.2, while CVE-2026-41948 remained pending at disclosure, with a fix merged on GitHub and additional mitigation available through targeted WAF rules; researchers also noted Dify's file parsing stack included vulnerable PDFium code affected by CVE-2024-5846.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly detailed the four DifyTap vulnerabilities, describing how they could enable persistent interception of AI chat messages and unauthorized access to uploaded documents and files. Zafran said it was not aware of real-world exploitation at the time of reporting.
Dify fixed all disclosed issues except CVE-2026-41948 in version 1.14.2, which the source says was released last month. The remaining flaw was not yet patched in that release.
Zafran Security identified four vulnerabilities in the Dify open-source AI workflow platform that could expose AI chats, uploaded documents, and files across users and tenants. The issues included unauthenticated attack paths, Plugin Daemon abuse, document preview authorization bypass, and cross-file access weaknesses.
For the remaining DifyTap flaw, CVE-2026-41948, a fix had been merged on GitHub by the time of reporting. Users still on version 1.14.2 could mitigate exposure with targeted WAF rules until the next release.
Until 2025-12-21, Dify's PDF preview capability relied on a Chromium PDFium binary affected by CVE-2024-5846, according to Zafran. The reference indicates this dependency issue ended on that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, tracked as CVE-2025-67732, was discovered in the open-source LLM app development platform Dify. The flaw allowed API keys to be exposed in plaintext through the model provider configuration endpoint, making them accessible to non-administrator users via the frontend. This exposure could enable unauthorized individuals to view and reuse the API keys, potentially granting them access to third-party services and consuming limited quotas. The issue was addressed and fixed in Dify version 1.11.0, mitigating the risk of unauthorized access. Security advisories highlighted the remote exploitability of this vulnerability, emphasizing the risk of API key leakage and subsequent misuse. The vulnerability was assigned a CVSS 4.0 score of 8.4, reflecting its high severity. Organizations using Dify are urged to update to version 1.11.0 or later to prevent exploitation and protect sensitive API credentials from exposure.
Jun 29, 2026
Security researchers reported two **high-severity vulnerabilities** in the open-source AI chatbot framework **Chainlit** that could enable sensitive data exposure and, in some environments, broader cloud compromise. The issues—**CVE-2026-22218** (arbitrary file read) and **CVE-2026-22219** (server-side request forgery, SSRF)—were described as “easy-to-exploit” and particularly risky because Chainlit-based applications are often deployed internet-facing and integrated with other enterprise services (for example, via common AI tooling and cloud backends). Technical details indicate CVE-2026-22218 can be triggered via a malicious element update request using a tampered custom element, allowing attackers to read files such as `/proc/self/environ` and potentially exfiltrate environment variables containing **API keys, credentials, and other secrets**. CVE-2026-22219 could allow SSRF against servers hosting AI applications, creating a path to access internal resources. Zafran reported responsible disclosure to maintainers in November and stated it had not observed in-the-wild exploitation; Chainlit released **version 2.9.4** to address both flaws, and organizations running Chainlit were advised to update to the patched release.
Jun 29, 2026
Multiple vulnerabilities in **TrueConf Server** were disclosed as affecting Windows deployments, including a **high-severity authentication bypass** tracked as `BDU:2025-10114`. The flaw stems from an alternative path or channel weakness (`CWE-228`) that allows remote attackers to send certain API requests without proper authentication, including access to some `/admin/*` endpoints where authorization checks are not correctly enforced. Russian vulnerability records state the issue affects multiple versions before vendor-fixed releases, that **exploit code exists**, and that the vulnerability has been **observed in attacks**. A related TrueConf Server issue, `BDU:2025-10115`, allows attackers to **read arbitrary files** on affected systems, expanding the risk from unauthorized administrative access to potential exposure of sensitive local data. Positive Technologies flagged both `BDU:2025-10114` and `BDU:2025-10115` as **trending vulnerabilities**, while a third identifier, `BDU:2025-10116`, was also listed without public technical details. The vendor has confirmed the disclosed issues and recommends applying the latest software updates and following official remediation guidance.
Jun 29, 2026