DifyTap: Four Unauthenticated Bugs in Dify Expose Cross-Tenant AI Conversations

Researchers have disclosed a set of four vulnerabilities in Dify, the open-source agentic workflow platform, that together allow an unauthenticated attacker to read AI conversations belonging to other tenants' applications.

Zafran Security is calling the cluster DifyTap.

The platform is widely deployed. Its GitHub repository carries more than 146,000 stars, putting it among the most-watched AI orchestration projects in the open-source ecosystem. That reach is what makes the disclosure significant for enterprise customers running multi-tenant Dify instances, whether self-hosted or managed.

According to the researchers, the flaws can be chained to siphon conversation data silently. No credentials are required. No user interaction is required. The read is passive from the victim's perspective, which means logs on the targeted tenant are unlikely to show the kind of authentication anomalies defenders typically hunt for.

That last point matters for incident response teams trying to scope exposure after the fact.

A few caveats are worth flagging up front. Public technical detail at disclosure is limited to the high-level behavior — cross-tenant read of AI conversations without authentication — and the DifyTap branding assigned by the finding team. CVE identifiers, affected version ranges, and patched release numbers have not yet been enumerated in primary advisories that this reporter could verify at the time of writing. Readers running Dify in production should monitor the project's GitHub security advisories feed at https://github.com/langgenius/dify/security/advisories for the authoritative fix matrix and any assigned CVE IDs.

For regulated operators, the disclosure raises a familiar question: does cross-tenant exposure of prompt content trigger notification obligations?

The answer depends on what was in the prompts. AI conversation logs frequently contain personal data, customer records, source code, or internal business information pasted by employees. Under GDPR Article 33, a confirmed unauthorized disclosure of personal data starts a 72-hour clock to the lead supervisory authority. SEC registrants subject to the Item 1.05 Form 8-K cybersecurity disclosure rule, effective since December 2023, would need to assess materiality if Dify-hosted workflows touch financial reporting or customer data of consequence. CIRCIA reporting for covered entities remains pending final rulemaking at CISA, with the proposed rule published in the Federal Register on April 4, 2024 and the comment period now closed.

The practical guidance is narrower.

Operators of self-hosted Dify should treat the instance as potentially exposed until they confirm a patched build, restrict network reachability of the admin and API surfaces, and pull conversation access logs for review against unexpected source IPs. Managed customers should request a written statement from their provider on patch status and any indicators of cross-tenant access during the vulnerability window.

Threat Vectr will update this story as primary advisories, CVE assignments, and vendor remediation guidance are published.