CVE-2026-41947

Think of Dify tracing like a “logging mirror” that can capture what an app processes. This flaw lets a logged-in editor user point that mirror at an attacker-controlled destination for other tenants’ apps, so sensitive messages can be copied out without needing to fully take over the system.

This matters if you run dify (self-hosted or otherwise) in a multi-tenant setup where different customers/teams share the same instance. It also matters if you have any user accounts with editor permissions that aren’t tightly controlled, because exploitation needs an authenticated editor user.

The risk is greatest when that editor account can reach and use the tracing configuration endpoints (and the instance is configured to allow tracing/trace configuration for applications).

This should be treated as a high-priority fix for businesses running dify because the problem can enable cross-tenant private data exposure via trace endpoint reconfiguration. While there’s no confirmed KEV entry and no public exploit code on record, security researchers have reported the issue and it can be abused by a tenant user who has editor access.

Patch to 1.14.2 promptly to prevent attackers from setting up a persistent exfiltration path through tracing.