Dify CVE-2026-41947

The attacker must hold an authenticated console session in some tenant of the target Dify instance (any editor-level account suffices) and must know or guess the target application's UUID, which is passed as the app_id path parameter to /console/api/apps/<app_id>/trace and /console/api/apps/<app_id>/trace-config. On Dify Cloud this prerequisite is effectively void because unauthenticated self-registration is open, matching the CVSS PR:N rating; on self-hosted deployments that require SSO, invitation, or admin-approved onboarding the bar is meaningfully higher. No user interaction by the victim is required and no special non-default Dify configuration is needed - the trace-config endpoints exist in the default console API; the only situational requirement is that the victim application be one whose telemetry the attacker wants to siphon (so a configured or about-to-be-used LLM app, otherwise no traffic flows through the redirected trace provider).

CVSS 4.0 scores this 9.1 with AV:N/AC:H/PR:N and high confidentiality and integrity impact, but those signals deserve nuance. PR:N is technically correct for Dify Cloud because self-registration is open, so the listed 'authenticated editor' requirement collapses to zero friction; for self-hosted deployments behind SSO or invite-only onboarding the practical privilege barrier is higher. AC:H is questionable given the exploit is a straightforward IDOR - the huntr bounty report and one-line diff indicate trivial reproduction, so attack complexity is arguably overstated. Exploitation is automatable (iterating app_ids), data confidentiality impact is severe (every prompt/response can be siphoned to an attacker's trace endpoint), and a working POC is public via huntr. EPSS and CISA KEV status were not supplied in the input data, so widespread active exploitation cannot be confirmed; treat this as a high-priority patch-now item for any internet-facing Dify Cloud or multi-tenant self-hosted instance.

An attacker self-registers a free Dify Cloud account, enumerates or guesses target application UUIDs (or harvests them from public sharing links), then POSTs to /console/api/apps/<victim_app_id>/trace-config with their own Langfuse credentials and enables tracing via the /trace endpoint. Every subsequent prompt submitted to the victim's chatbot, along with the LLM's responses, is mirrored to the attacker's trace dashboard - exfiltrating proprietary system prompts, end-user PII, and business data in real time. Working exploit guidance is published in the huntr bounty report.