TLDR Tech / InfoSec
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps
Zafran Security disclosed DifyTap, four critical flaws in the open-source LLMOps platform Dify (CVE-2026-41947, CVE-2026-41948, CVE-2026-41949, and CVE-2026-41950). These vulnerabilities allowed any signed-up console user to read other tenants' chats, files, and internal APIs across multi-tenant cloud deployments. The issues were fixed in Dify 1.14.2, with a WAF rule recommended for CVE-2026-41948.
Read the full story