CVE Intelligence
Analysis AI-assisted

CVE-2026-41948: Dify path traversal via Plugin Daemon internal API

Dify 1.14.1 and earlier contain a path traversal flaw that lets authenticated users reach internal Plugin Daemon REST API endpoints. The record lists a CVSS score of 9.4 from NVD and VulnCheck, and no confirmed exploitation appears in the sources consulted, although the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-41948 is a path traversal weakness (CWE-23, Relative Path Traversal) in Dify, a platform for building AI applications. According to the description, insufficient sanitization of URL paths in requests forwarded to the Plugin Daemon internal REST API lets authenticated users move outside their authorized tenant path. The record was published on 2026-05-18 by VulnCheck as CNA and its status is Modified.

Impact

  • The description states that attackers can reach internal endpoints such as debug interfaces and that only knowledge of the victim tenant UUID is required.
  • The description also notes that Dify Cloud allows unauthenticated free self-registration, so account creation is easily available to an attacker.
  • The vector string in the record lists high confidentiality impact, high integrity impact and low availability impact. The SSVC data lists technical impact as total and automatable as no.
  • The severity is labeled critical in the record, with a CVSS score of 9.4 from NVD and VulnCheck. A score of 7.7 from GitHub is also listed.

Affected products and versions

  • The record lists the affected products as Dify (Dify Dify and Langgenius Dify) with versions up to and including 1.14.1.
  • The record does not name a fixed release. It links to a patch pull request, GitHub PR 35796, but does not say which release includes the change.

Exploitation status

  • The record shows the CVE as not listed in CISA KEV, so no active exploitation is confirmed by that catalog.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The SSVC data lists exploitation as proof of concept, which means public proof-of-concept material is considered to exist.
  • The EPSS probability is 0.01892 with a percentile of 0.79437, as given in the record.

Remediation and mitigation

  • Update Dify to a release that includes the fix referenced in GitHub PR 35796 and confirm the installed build after the update.
  • Because the record does not give a fixed version, check the upstream GitHub advisory and release notes before rolling out the change.
  • Restrict network access to the Plugin Daemon and its internal endpoints so that only trusted components can reach them.
  • Review whether self-registration is needed in your environment and limit account creation where it is not required.
  • Prioritize this item because of the critical score and the tenant-crossing nature of the flaw described.

Detection guidance

  • Review web and API logs for requests with unusual or encoded path segments directed at Plugin Daemon routes.
  • Monitor for spikes in new account registrations and for access patterns that cross tenant boundaries.
  • Alert on access to debug or internal endpoints from sources other than the expected internal services.

Limitations of the available information

  • The record does not provide a fixed version number or a release that contains the fix.
  • The record does not confirm the full set of internal endpoints affected.
  • The sources consulted do not confirm exploitation in the wild, but they do not rule it out.
  • The record includes a VulnCheck CVSS score in the newer series and a 9.3 score, but the analysis here does not reproduce those vectors.
  • The EPSS date in the record is later than the publication date and should be verified against the current EPSS data before use.
  • Details from the referenced technical pages are not reproduced here.

Frequently asked questions

Which Dify versions are affected by CVE-2026-41948?

The record lists Dify versions up to and including 1.14.1 as affected. It does not name a fixed release, so check the linked patch and advisory before upgrading.

Is this vulnerability being actively exploited?

The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC data lists exploitation as proof of concept.

What should administrators do first?

Apply the fix referenced in the patch pull request, restrict network access to the Plugin Daemon internal endpoints, and review whether public self-registration is needed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.