Software
Breachwright← Back to the database
critical · 9.1Maintainer reviewedAASD-2026-0003
Dify trace authorization bypass permits cross-tenant AI conversation exfiltration
Dify versions before 1.14.2 did not verify tenant ownership when an authenticated editor configured tracing for an application. A caller who obtained another application's internal identifier could enable an attacker-controlled tracing provider for that application, causing prompts and model responses to be copied across the tenant boundary.
Prerequisites
- A Dify deployment before version 1.14.2 is reachable by the attacker
- The attacker can authenticate as an editor, including through permitted self-registration
- The attacker can obtain the internal identifier of a victim application
Potential impact
- Cross-tenant disclosure of prompts, model responses, and other trace content
- Unauthorized modification of a victim application's observability destination
- Ongoing exfiltration while the malicious trace configuration remains enabled
Mitigations
- Upgrade Dify to version 1.14.2 or later
- Restrict self-registration and grant editor roles only to trusted users
- Audit application trace configurations and alert on unexpected provider destinations
- Constrain outbound access from Dify services to approved observability providers
- Treat exposed prompt and response content as compromised and rotate any secrets it contained
Public sources
Research note
The CVSS vector treats privileges as none because Dify Cloud permits free self-registration; the attack still requires an editor session, so the AASD attack field records low privileges. Not listed in the CISA Known Exploited Vulnerabilities catalog when verified on 2026-07-28.