CVE-2025-67732: 
Dify vulnerability analysis and mitigation

CVE-2025-67732 is a plaintext API key exposure vulnerability in Dify, an open-source LLM app development platform. The flaw allows non-administrator users to view and reuse API keys configured by administrators, potentially enabling unauthorized access to third-party services. It affects all Dify versions up to and including 1.10.1-fix.1, and was disclosed on January 4–5, 2026, with a fix released in version 1.11.0. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.4 (High) (GitHub Advisory).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-522 (Insufficiently Protected Credentials). The vulnerable endpoint /console/api/workspaces/current/model-providers returns full model provider configuration data — including plaintext API credentials — to any authenticated user, regardless of their privilege level. A non-administrator user can intercept this API response (e.g., via browser developer tools on the Plugins page) and extract the API key from the JSON path custom_configuration.custom_models[0].credentials.api_key. No special tooling or elevated privileges beyond a standard user account are required (GitHub Advisory).

Successful exploitation allows non-administrator users to obtain plaintext API keys for third-party services (e.g., OpenAI-compatible providers) configured by administrators. Attackers can use these keys to make unauthorized API calls, consume quota, potentially incur financial costs, or access data exposed through those third-party services. While the vulnerability does not directly compromise the Dify host system, the downstream impact on integrated services — including potential data access and service disruption — can be significant depending on what those services control (GitHub Advisory, SecurityOnline).

No public proof-of-concept exploit code has been released, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.046%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and the only requirement of a valid (non-admin) user account make it straightforward to exploit in any multi-user Dify deployment (GitHub Advisory).

1. Obtain a non-administrator account: Register or log in to a Dify instance as any non-administrator user.
2. Navigate to the Plugins page: In the Dify web interface, open the Plugins section where model providers are listed.
3. Open browser developer tools: Use the browser's built-in developer tools (F12) and navigate to the Network tab.
4. Capture the API request: Reload the Plugins page or trigger a page action that calls /console/api/workspaces/current/model-providers.
5. Extract the API key: In the captured response JSON, locate the entry for the configured provider (e.g., langgenius/openai_api_compatible/openai_api_compatible) and extract the plaintext API key from custom_configuration.custom_models[0].credentials.api_key.
6. Reuse the API key: Use the extracted key to make direct API calls to the third-party service (e.g., OpenAI-compatible endpoint), bypassing authorization controls and consuming the administrator's quota (GitHub Advisory).

• Network: Unusual or repeated HTTP GET requests to /console/api/workspaces/current/model-providers from non-administrator user sessions; API calls to third-party services (e.g., OpenAI endpoints) originating from unexpected IP addresses using the organization's API keys.
• Logs: Dify access logs showing non-admin users frequently accessing the model-providers endpoint; third-party service provider logs showing API key usage from unfamiliar IP addresses or at unusual times.
• Third-Party Service: Unexpected quota consumption or billing anomalies on integrated LLM provider accounts (e.g., OpenAI, Azure OpenAI) that do not correlate with legitimate administrator usage.

The primary remediation is to upgrade Dify to version 1.11.0 or later, which patches the plaintext API key exposure in the model-providers endpoint. Organizations should also immediately rotate any API keys that may have been exposed in earlier versions, as those keys should be considered compromised. As an interim measure, restrict access to the Dify console to trusted users only, and consider using network-level controls to limit who can reach the /console/api/ endpoints. Going forward, store API credentials in secure vaults or environment variables rather than returning them in frontend-accessible API responses (GitHub Advisory).

SecurityOnline covered the vulnerability shortly after disclosure, highlighting its high-severity CVSS v4.0 rating and the straightforward exploitation path available to any authenticated user (SecurityOnline). A blog post on CryptoBivash noted that Dify logs could become a source of API key theft, emphasizing the risk to organizations running multi-user Dify deployments. Qualys included the vulnerability in its January 2026 application security detections publication. Community reaction has been moderate, with the issue noted across vulnerability tracking platforms including VulnDB, CVEFeed, and SecAlerts.