CVE-2026-41947: Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. Attackers can exploit missing tenant ownership checks in the trace configuration endpoints to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 1.14.2 - Compensating control
Restrict access to trace configuration endpoints so that authenticated editor users can only modify trace configurations for applications they own within their tenant.
- Compensating control
For Dify Cloud, limit or disable unauthenticated free self-registration so attackers cannot trivially create accounts to exploit the trace configuration authorization bypass.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41947?
CVE-2026-41947 is considered a critical vulnerability due to its potential to allow unauthorized access to sensitive application configurations.
How do I fix CVE-2026-41947?
To fix CVE-2026-41947, upgrade Dify to version 1.14.2 or later, which addresses the authorization bypass vulnerability.
Who is affected by CVE-2026-41947?
CVE-2026-41947 affects users of Dify version 1.14.1 and earlier, specifically those using the trace configuration features.
What type of vulnerability is CVE-2026-41947?
CVE-2026-41947 is classified as an authorization bypass vulnerability, allowing inappropriate access to configure trace settings.
Can unauthorized users exploit CVE-2026-41947?
Yes, CVE-2026-41947 can be exploited by authenticated editor users to bypass authorization checks for trace configurations.