Is CVE-2026-41947 actively exploited?

No active exploitation of CVE-2026-41947 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41947 be exploited remotely?

Yes. CVE-2026-41947 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41947?

CVE-2026-41947 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-41947

CRITICAL

CVE-2026-41947

CWE-639Published: May 18, 2026· Updated: May 19, 2026

9.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.5th

Official Description

Dify version 1.14.1 and prior contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. Attackers can exploit missing tenant ownership checks in the trace configuration endpoints to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

NVD Source

Risk Analysis

This critical authorization bypass vulnerability in Dify allows authenticated editor users to configure tracing for any application, regardless of tenant ownership. Attackers can redirect victim application messages to their own LLM trace providers due to missing tenant ownership checks. With a CVSS score of 9.1, this is a serious concern, particularly as Dify Cloud enables easy account creation.

No public exploit is currently known for this vulnerability. The flaw is remotely exploitable and requires authentication, though Dify Cloud's free self-registration makes obtaining credentials trivial.

Recommended Action

Upgrade Dify to a version beyond 1.14.1 to resolve the authorization bypass. Ensure that all trace configuration endpoints properly enforce tenant ownership checks.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-41947 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.