Blog Published: Jul 6, 2026

DifyTap Turns Multi-Tenant AI App Plumbing Into a Data Exposure Problem

Zafran's DifyTap research combined unauthenticated conversation exposure, Plugin Daemon (Dify's plugin service) access paths, cross-tenant document preview risks, and a PDF preview parser issue in Dify (a platform for building multi-tenant AI applications). The strongest defensive lesson is not a single patch: multi-tenant AI platforms need object-level authorization, tenant-state isolation, telemetry redaction, and sandboxed document handling at every lifecycle boundary.

Credential ExposurePrivacy LeakageData GovernanceSession IsolationMulti-Tenant AI
7 applicable AIDEFEND defenses
Source: DifyTap: Zafran Discovers How Attackers Can Silently Wiretap AI Data Across Tenants on a Platform Powering 1M+ Apps 
Authors: Ido Shani & Gal Zaban
Original article: Jun 22, 2026

Threat Analysis

  • The research is a family of related data paths, not one single exploit line. Zafran documented several Dify surfaces that could expose private AI conversations, files, tenant identifiers, or parser attack paths.
  • Conversation and trace data are sensitive AI state. Prompt and response history can contain credentials, customer data, internal reasoning, or operational instructions, so unauthenticated or cross-tenant access is a direct data-governance failure.
  • The Plugin Daemon path matters because it bridges trust zones. Internal APIs behind plugin infrastructure can become cross-tenant access paths if caller, tenant, session, and object authorization are not bound together.
  • Document preview expands the boundary from text to files. A PDF preview path can leak documents across tenants or trigger parser memory corruption if file handling is not sandboxed.
  • The reader-owned work is deployment assurance. Patch to Dify 1.15.0 or later, but also test tenant isolation, log redaction, preview sandboxing, and data-access decisions in your own deployment.

Applicable AIDEFEND Defenses (7)

AID-H-034.003
Server-Side Tool Invocation Validation & Object-Level Authorization
Very High
Server-side object-level and tenant-level authorization is the direct fix for DifyTap’s core failure. The Dify API, the Plugin Daemon’s internal endpoints, and the document-preview handlers must each bind caller, tenant, session, and target object on every request, so no request can read or act on another tenant’s conversation, file, or plugin object - authorized at each data transition, not only at login.
AID-H-032.002
Cross-Tenant Serving-State Isolation
Very High
Cross-tenant serving-state isolation addresses the core multi-tenant risk: cached state, preview state, queues, and warm resources must not be reused across tenant boundaries.
AID-H-032.003
Inference Telemetry & Debug Surface Restriction
High
Telemetry and debug surfaces should redact prompts, outputs, retrieved context, and tool arguments before logs or traces can expose another tenant's AI data.
AID-H-002.003
Multimodal Input Sanitization
High
Multimodal input sanitization and file-type safety gates are a direct fit for the PDF preview path, where uploaded files cross into parser and rendering components.
AID-I-001.003
Ephemeral Single-Use Sandboxes for Tools
High
Ephemeral single-use sandboxes keep preview parsing and plugin tools from sharing durable state or credentials if a malformed document triggers parser compromise.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
Track the exact deployed Dify and Plugin Daemon versions affected by the DifyTap routes, rebuild and stage the fixed releases, and prove by fleet readback that no vulnerable application or plugin-service instance remains. This owns remediation delivery and completion, while AID-E-004 separately proves the exploit paths are closed.
AID-E-004
Incident Exploit-Path Closure Verification
High
After the Dify and Plugin Daemon fixes are deployed, independently replay every incident-defined DifyTap route and verify that tenant/object authorization and parser boundaries deny the original requests across the affected population. This is closure verification, not patch rollout or WAF deployment.

What Defenders Should Do Now

  • Upgrade Dify to 1.15.0 or later and verify the exact deployed Plugin Daemon, API, and document-preview components.
  • Run tenant-isolation tests for chat history, trace views, file UUIDs, preview endpoints, and plugin internal APIs.
  • Move prompt, response, trace, and document-preview access behind object-level authorization that binds caller, tenant, session, and backend object.
  • Sandbox PDF and document preview workers with no durable tenant state and no production credentials.
  • Audit logs and traces for prompt, output, retrieved context, file metadata, and secret leakage across tenants.

Conclusion

DifyTap is a reminder that multi-tenant AI platforms carry more sensitive state than a normal SaaS screen. Prompts, traces, files, plugin calls, and preview workers all need tenant-bound authorization and isolated runtime state. A patch closes known bugs; the architecture has to prevent the next cross-tenant data path from becoming the same incident with a new URL.