Which versions of Dify are affected by CVE-2026-41947?

LangGenius Dify versions through 1.14.1 contain a critical cross-tenant authorization bypass where publicly available exploit code exists, allowing any registered user to redirect competitors' or…. A patch is available.

Is there a public PoC exploit available for CVE-2026-41947?

Yes, a public proof-of-concept exploit is available for CVE-2026-41947. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-41947?

Within 24 hours: Verify Dify deployment version and assess scope of multi-tenant isolation; implement enhanced logging on trace-configuration API endpoints to detect unauthorized modifications. Within 7 days: Apply vendor patch by upgrading Dify to a version after 1.14.1 that includes the authorization fix from PR #35793; audit and rotate any observability provider credentials configured in Dify trace settings. Within 30 days: Conduct full audit of trace configuration modification history; verify no unauthorized cross-tenant trace redirections occurred; review editor account creation and API access logs for suspicious activity correlating to vulnerability announcement date.

Dify CVE-2026-41947

Q: What is the CVSS score of CVE-2026-41947?

CVE-2026-41947 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30772 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-18 VulnCheck

GHSA-48v9-p8g8-55vg

Authentication Bypass Dify

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 26, 2026 - 17:22 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

Analysis Updated

May 18, 2026 - 15:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 18, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

May 18, 2026 - 15:22 NVD

HIGH CRITICAL

CVSS changed

May 18, 2026 - 15:22 NVD

7.4 (HIGH) 9.1 (CRITICAL)

Source Code Evidence Fetched

May 18, 2026 - 15:00 vuln.today

Analysis Generated

May 18, 2026 - 15:00 vuln.today

DescriptionCVE.org

Dify version 1.14.1 and prior contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. Attackers can exploit missing tenant ownership checks in the trace configuration endpoints to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

AnalysisAI

Cross-tenant authorization bypass in LangGenius Dify versions through 1.14.1 lets any logged-in editor reroute another tenant's LLM trace traffic - including prompts and model responses - to an attacker-controlled observability provider. Because Dify Cloud permits free self-registration, the authentication barrier is effectively trivial; publicly available exploit code exists and a vendor patch is shipped via PR #35793. The flaw is an instance of CWE-639 (insecure direct object reference) in the trace-configuration endpoints, which accepted an app_id without validating tenant ownership.

Technical ContextAI

Dify is an open-source LLM application development platform (CPE cpe:2.3:a:langgenius:dify) whose console API exposes per-application tracing controls that integrate with external observability providers such as Langfuse. The vulnerable handlers in api/controllers/console/app/app.py (AppTraceApi) and api/controllers/console/app/ops_trace.py (TraceAppConfigApi) accepted a raw app_id UUID from the URL and forwarded it directly to OpsTraceManager / OpsService without confirming that the caller's tenant owned the application - a textbook CWE-639 Authorization Bypass Through User-Controlled Key. The upstream fix replaces the raw UUID parameter with the @get_app_model decorator, which resolves the app through the requesting account's tenant scope and returns 404 when the app belongs to another tenant, as the new integration test test_trace_endpoints_hide_apps_from_other_tenants demonstrates.

RemediationAI

Upgrade Dify to the version that incorporates PR #35793 (https://github.com/langgenius/dify/pull/35793), which introduces the @get_app_model tenant-ownership decorator on the AppTraceApi and TraceAppConfigApi GET/POST/PATCH/DELETE handlers; an exact tagged release version was not provided in the input data, so confirm the fix is included against the vendor's release notes before deploying. Where immediate upgrade is impossible, compensating controls include disabling external trace-provider integrations entirely (removes the high-value sink, at the cost of losing Langfuse/observability features), placing the /console/api/apps/<app_id>/trace and /trace-config endpoints behind a reverse-proxy WAF rule that enforces session-to-tenant binding, and on Dify Cloud temporarily disabling open self-registration to raise the cost of account creation (which breaks the public signup flow). Rotate any third-party LLM trace-provider API keys that may have been exposed and audit existing trace configurations across applications for unfamiliar provider endpoints.