CVE-2025-67732: Dify Patch Fixes High-Severity Plaintext API Key Exposure

CVE-2025-67732: Dify patch fixes a high-severity plaintext API key exposure in the open‑source platform used for LLM applications and RAG pipelines. The flaw, rated with a CVSS of 8.4, drives the frontend to reveal private API keys by returning the full configuration object from the backend endpoint /console/api/workspaces/current/model-providers instead of redacting credentials.

A typical response includes the api_key in a custom_configuration block, meaning non-administrator users can view these keys via the Dify console. According to the disclosure, an attacker doesn’t need sophisticated tools—just a web browser—to extract the plaintext key, for example from custom_configuration.custom_models[0].credentials.api_key.

The issue affects Dify versions 1.10.1-fix.1 and earlier, and the development team has addressed it in the latest release; users are urged to upgrade to version 1.11.0 immediately to keep API keys secret.