Executive brief
Dify, an open-source platform for building AI applications, contains a security flaw in how it manages application tracing configurations. An attacker with a standard account can bypass security checks to modify the settings of applications belonging to other organizations. This allows the attacker to redirect sensitive AI chat logs and responses to their own servers, potentially exposing confidential business data and user interactions.
Technical details
An authorization bypass vulnerability (CWE-639) exists in Dify's trace configuration endpoints (/console/api/apps/<app_id>/trace-config). The application fails to perform tenant ownership validation when processing GET, POST, PATCH, and DELETE requests for these endpoints. An authenticated attacker can provide a victim's app_id to read or modify tracing settings, enabling the redirection of LLM prompts and responses to attacker-controlled Langfuse or OpenTelemetry endpoints. While the CVSS vector suggests high complexity, the vulnerability is easily reachable due to Dify Cloud's free self-registration. The issue was addressed in pull request #35793 by enforcing tenant scoping via the @get_app_model decorator.
Affected products
- langgenius Dify <= 1.14.1
Timeline
- 2026-05-05: other: Initial fix proposed in pull request
- 2026-05-14: patched: Fix merged into main branch
- 2026-05-18: disclosed: CVE published and NVD record created