Disclosed weakness · no CVE recorded

Dify outbound requests can inherit another workspace’s cookies

Dify · Dify HTTP nodes, custom API tools and other outbound request clients

First documented disclosure · Review checkpoint

Summary

Two workspaces that contact the same service can send each other’s cookies under a pooled HTTP client.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The patch author reproduced cross-tenant cookie reuse locally with concurrent redirecting requests. No production incident was reported.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The process reuses an HTTP client per TLS verification mode. Its shared cookie jar saves Set-Cookie responses and selects matching cookies for later requests or another workspace’s redirect.

Conditions required

Multiple requests share a pooled client. The destination must match the cookie’s domain, path and other transport rules. The destination or tool must give the cookie meaning for a security impact.

Potential impact

A request can carry another workspace’s session or state to the matching host. Exposure and the resulting actions depend on how the remote service handles the cookie.

Affected versions and configurations

1.18.0 has the pooled client without request-scoped cookie storage. Builds containing the earlier pooling change may also be affected. A complete version range was not established.

Fix and mitigation status

1.19.0 documents and contains request-scoped cookie handling.

Practical next steps

Update to a release containing the 1.19.0 fix. Review shared external integrations that use cookie-based sessions and revoke any session shown to have crossed workspaces.

Operating lesson

Keep outbound session state private to one tool request even when the underlying connection pool is shared.

Evidence and limits

The October 23 public fix describes the cross-workspace behavior. The 1.19.0 release followed November 4. Redirects inside one request can still use cookies the destination deliberately sets. No CVE or score was identified for this patch.

Sources