Researchers from Zafran Security have detailed a cluster of flaws, collectively named DifyTap, that could let attackers silently read AI conversations belonging to other tenants on the open-source Dify platform.
Summary
- Zafran Security has disclosed four vulnerabilities in Dify, an open-source agentic workflow platform, collectively labelled DifyTap.
- The flaws could allow an attacker to read AI conversations from other customers’ applications without needing to authenticate.
- Dify has more than 146,000 GitHub stars, indicating broad adoption across development and enterprise environments.
- No corroborating sources were available at time of publication; the primary source is The Hacker News reporting on Zafran Security’s research.
- Organisations self-hosting or consuming Dify in multi-tenant configurations should treat this as a priority review item.
What Has Been Disclosed
Cybersecurity researchers at Zafran Security have published details of four vulnerabilities affecting Dify, an open-source platform used to build agentic AI workflows. The vulnerabilities have been grouped under the name DifyTap. According to the research, the flaws could allow an attacker to access AI conversation data belonging to other tenants on the same platform instance — and to do so without any form of authentication.
Why Dify Is Worth Paying Attention To
Dify has accumulated more than 146,000 stars on GitHub, placing it among the more widely adopted tools in the agentic AI space. That level of uptake means the platform is likely embedded in a meaningful number of development pipelines, internal tooling stacks, and customer-facing AI products. The broader the deployment footprint, the more consequential any cross-tenant data leakage becomes.
The Nature of the Exposure
The core concern is cross-tenant visibility — specifically, the ability to read conversations that should be logically isolated between separate application owners or customers. In a multi-tenant deployment, the expectation is that one tenant’s data is invisible to all others. If these vulnerabilities can be exploited as described, that boundary breaks down. The fact that no authentication is required to trigger the exposure raises the severity further: an attacker does not need a valid account on the target tenant, only access to the platform.
What the Sources Do Not Tell Us
It is worth being direct about the limits of what is currently known from the available source material. The specific technical mechanisms behind each of the four vulnerabilities have not been detailed in the primary source summary available to this publication. It is also not confirmed whether patches have been released, whether the vulnerabilities affect only self-hosted deployments or also any cloud-hosted Dify offering, or whether there is any evidence of active exploitation in the wild. Organisations should consult Zafran Security’s full disclosure and Dify’s official communications for that detail.
Multi-Tenant AI Platforms Carry Inherent Isolation Risk
This disclosure sits within a broader pattern worth naming. As organisations deploy AI platforms that serve multiple internal teams or external customers from a shared infrastructure, the attack surface for cross-tenant data exposure grows. Conversations with AI systems can contain sensitive operational content, customer information, or intellectual property. A flaw that undermines tenant isolation in this context is not merely a technical issue — it is a potential data breach vector with regulatory and contractual implications.
Why it matters
For CISOs, DifyTap is a prompt to audit any deployment of Dify within their environment — particularly those running in multi-tenant configurations or exposed beyond a tightly controlled internal network. If Dify is used to power customer-facing AI features or to process sensitive internal conversations, the possibility of unauthenticated cross-tenant access represents a material data confidentiality risk. Even organisations that have not yet assessed Dify as a significant risk asset should reconsider that classification in light of this research. The broader lesson is that agentic AI platforms, which by design handle rich conversational data across many users and applications, require the same rigorous isolation and access-control scrutiny as any other multi-tenant SaaS or PaaS layer in the stack.
What to do now
- Identify all instances of Dify deployed across your environment, including those managed by development teams or embedded in third-party tooling.
- Review Zafran Security’s full DifyTap disclosure and any official Dify security advisories for technical detail and patch guidance.
- Assess whether your Dify deployments operate in a multi-tenant configuration and whether sensitive AI conversation data is being processed on those instances.
- Apply any patches or mitigations released by the Dify project as soon as they are available and verified.
- If patching cannot be applied promptly, consider restricting network access to Dify instances as a temporary risk reduction measure.
