CVE-2026-41947

Dify remediation should retain controls until CVE-2026-41948 closure is verified

→Treat the packet's Dify 1.14.2 guidance as necessary but not complete remediation until public vendor release or advisory evidence confirms CVE-2026-41948 closure; retain WAF/ACL restrictions and tenant-crossing access hunting in the meantime.

Dify operators should apply available updates while retaining compensating controls on trace/config and plugin-daemon paths until public vendor evidence confirms CVE-2026-41948 is closed. Review tenant-crossing access patterns during that period.