DifyTap the vulnerability that creates a silent way to exfilter conversations and documents on multi-tenant platforms

Security researchers have identified a chain of failures in Dify, an open-source platform for agent workflows and more than 146,000 stars in GitHub, which allowed for silently exfiltered conversations and files from other applications hosted in their multi-tenant service. The set of failures, baptized by the discoverers as DifyTap, includes errors in the authorization and consolidation of routes that, combined, enable an attacker to read messages, model responses and other documents without complex authentication or privileged access.

Beyond the headline, the real gravity lies in the persistent and discreet nature of the escape channel: an attacker can freely register on the platform, set up his own trace provider for a public application and redirect all tracking calls there, thus creating a silent track to capture each input and response generated by models. In addition, other defects allowed to manipulate requests to the internal plugin service and to preview fragments of documents only knowing an UUID, a situation that breaks the limits of isolation between tenants and users within the same tenant.

The report also points to dependence on a vulnerable version of PDFium with a type use-after-free failure (registered as CVE-2024-5846), which could be exploited with a malicious PDF to corrupt memory in the parseum process. The combination of logical vulnerabilities on the platform and vulnerable native libraries underlines the need to address both the web area and third-party stack.

For those who operate or develop on IA multi-tenant platforms there is a clear set of lessons: strictly validate the separation between tenants, minimize the exposure of resource identifiers and do not trust the presence of authentication per se. In practice this means reviewing authorisation controls on endpoints that accept UUIDs or routes, applying robust URLs sanitation, and preventing internal endpoints (such as daemon de plugins) from being accessible from the public layer of the application.

As for immediate actions, Dify operators should update to the version where most of the failures have been corrected (the patch was published in the release v1.14.2) and monitor the next delivery to solve the remaining outstanding problems. You can see the version in the Dify official repository: https: / / github.com / didy-ai / digy / releases / tag / v1.14.2. It is also appropriate to update PDFs rendering libraries and to review CVEs known, for example the NVD entry on PDFium vulnerability: https: / / nvd.nist.gov / vuln / detail / CVE-2024-5846.

To reduce the risk while patches are deployed, it is advisable to restrict public access to unnecessary applications, disable external trace providers to check their safety, rotate credentials and integration keys, and enable integrity monitoring and specific alerts for abnormal trace rates or requests to internal endpoints. At the development level, introducing automated tests that simulate multi-tenant contexts (including traversals attempts and third-party UUIDs uses) will help to detect regressions in access controls.

Finally, the impact highlights a structural problem in container-based ecosystems and units in native libraries: the differences between deployments (images, runtime flags, network configuration) can create "cracks" that traditional scanners do not see. Recommendation for product managers: combine static and dynamic analysis, include pentesting tests focused on tenant isolation, and maintain bug bounce programs to capture logical errors that do not appear in unit analysis.