Blog | Dify

Security vulnerabilities found in this release.0 Critical · 22 High CVE across all container images

Image

critical

high

medium

low

Status

FAIL

PASS

FAIL

PASS

FAIL

PASS

FAIL

PASS

ScannerDocker Scout

Scanned

Oct 09, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

pip-vendored.openvex.json uv-vendored.openvex.json

VEX (Vulnerability Exploitability eXchange) documents record why the flagged CVEs are not exploitable in Dify Enterprise.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

161.1

MIN

128

MAX

548

P50

148

P90

174

P95

189

Connections

Max Concurrent

Avg Active

17.27

Empty Workflow QPS

Max QPS

Avg QPS

36.1

Avg Duration (ms)

178.54

License Compliance

All dependencies compliant - no copyleft issues detected

Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0

Release v3.13.0

September 29, 2026 · 9 min read

What Changed

New Features

Multi-Environment DeploymentAdministrators can create environments such as test and prod and configure their resources in the enterprise dashboard. Deploy different published versions of Studio apps to each environment with separate credentials and environment variables. Supports Workflow and Chatflow apps.

Workspace-Level Skills ManagementWorkspaces now support creating, importing, editing, publishing, and versioning reusable Skills containing instructions, scripts, and reference materials. Skills can be used by Agent apps and Agent nodes in workflows, with a built-in Skill Builder, file editor, and granular access controls.

Invocation LogsAdministrators can view app invocation logs across environments in the enterprise dashboard. Inspect the status, duration, token usage, and error details of each invocation to troubleshoot runtime issues.

Agent: Runtime Environment SnapshotsSaves the sandbox environment home directory state during Agent release builds, enabling new sandbox instances running the Agent to reuse pre-packaged dependencies and files.

Plugin Management: Install in Every WorkspaceAdministrators can select "Install in every workspace" for a plugin in the enterprise dashboard. The plugin is installed in existing and newly created workspaces, keeping them on the selected version.

Improvements

RBAC: Granular Agent PermissionsThe single workspace-level agent.manage permission is replaced by agent.create and per-Agent permissions for previewing, editing, testing and running, releasing and managing versions, viewing and managing access points, viewing and managing logs, monitoring, configuring access, importing and exporting DSL, and deleting Agents.

Helm: Per-Site Gateway Response HeadersSupports customizing Gateway HTTP response headers per site via Helm while preserving default header behavior.

Bug Fixes

Admin API RBAC Binding SyncFixed an issue where RBAC permission bindings were not updated when adding or removing workspace members via the Admin API.

Knowledge Base Permission Check 403 ErrorsFixed an issue where 403 errors were incorrectly triggered by legacy permission checks even when knowledge base access was granted.

Workspace Owner Transfer Role SyncFixed an issue where the previous owner role processing and enterprise dashboard display became out of sync after transferring workspace ownership.

SSO Outbound Request Proxy ConfigurationFixed an issue where outbound requests initiated by SSO ignored HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables.

Open in Explore for SSO-Restricted AppsThe Open in Explore action is now hidden for apps restricted to authenticated external users. Previously, this action failed with a misleading "App is not yet published" message.

Web App SAML Authentication Callback RedirectionFixed an issue where completing SAML authentication callbacks in web applications incorrectly redirected users to the console.

SSO: Admin Login with Expired LicensesFixed an issue where expired licenses or exceeded seat limits blocked enterprise dashboard SSO logins, preventing administrators from accessing the system for activation.

Imported Workflow Persistence After PublishingFixed an issue where refreshing the page after successfully publishing an imported workflow caused the workflow to disappear.

Human Input Test Email Modal StatusFixed an issue where opening the test email modal a second time in Human Input nodes falsely displayed the email as sent when it was not.

Prompt Generator: Model Parameter ConfigurationFixed an issue where the prompt generator ignored user-configured model parameters, causing execution errors when using models such as Qwen.

Agent: Duplicate Tool ResultsFixed an issue where tools returning both JSON and text formats caused Agents to receive duplicate results.

User Feedback and Prompt Generation MetricsFixed an issue where metrics related to user feedback and prompt generation were missing from monitoring telemetry.

Workflow Node Execution Metrics and TracingFixed an issue where workflow node execution metrics and trace tracking data were missing.

Unconfigured Tracing Provider HandlingFixed an issue where querying unconfigured providers returned 500 errors when optional tracing SDKs were missing.

Plugin Pod Graceful TerminationFixed an issue where plugin Pods failed to terminate gracefully during shutdown.

Invalid UUID Parameter Response CodeFixed an issue where passing invalid UUID parameters returned a 500 internal server error code instead of 400 bad request.

Pre-installed spaCy Model for Offline Email ExtractionFixed an issue where MSG/email parsing failed in offline environments due to a missing spaCy English model by pre-installing the model in the container image.

Application Deletion Audit LogsFixed an issue where audit log entries were missing during application deletion due to incomplete or missing resource associations.

Helm: Squid Startup Out-of-Memory ErrorsFixed an issue where Squid crashed with out-of-memory errors on startup when host file descriptor limits were set too high, resolved by capping file descriptors via Helm.

Security Notes

Security: setuptools / msgpack CVEs do not affect runtimeThe setuptools and msgpack CVEs flagged by this release's scanner are introduced by dependencies vendored inside the base image's system pip (pip/_vendor). They are not installed in the application virtualenv nor imported by the runtime (which uses uv-managed venvs), so they are not exploitable. The assessment covers four advisories (CVE-2026-57585, GHSA-6v7p-g79w-8964, CVE-2025-47273, CVE-2026-59890); see the VEX (Vulnerability Exploitability eXchange) document linked in the Security & CVE section for the full details.

Security: nltk path-traversal advisory has no upstream fixCVE-2026-81726 (path traversal in nltk ≤ 3.10.3) is still reported against the API image and has no fixed release upstream. It is the only high-severity finding in the default dify-ee-api image that is not covered by the VEX document; we are tracking the upstream fix and will ship it as soon as one is published.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

If your deployment uses ChromaDB, review the known vulnerabilities before selecting the dify-ee-api-insecure:3.13.0 image

Confirm Kubernetes cluster has sufficient resources for rolling update

Schedule a maintenance window; after upgrading, run flask rbac-migrate-agent-permissions (dry run by default), then rerun with --apply (see Migration Notes)

Review the migration requirements of earlier releases when upgrading across multiple versions

Upgrade Command

# Back up database first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.13.0

Rollback

$ helm rollback dify 0

Security & CVE

Security vulnerabilities found in this release.0 Critical · 28 High CVE across all container images

critical

high

medium

low

Status

FAIL

PASS

FAIL

PASS

FAIL

PASS

FAIL

PASS

FAIL

PASS

ScannerDocker Scout

Scanned

Sep 29, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

pip-vendored.openvex.json

VEX (Vulnerability Exploitability eXchange) documents record why the flagged CVEs are not exploitable in Dify Enterprise.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

412.64

MIN

242

MAX

1441

P50

271

P90

701.1

P95

966.5

Connections

Max Concurrent

Avg Active

2.9

Empty Workflow QPS

Max QPS

19.6

Avg QPS

17.63

Avg Duration (ms)

590.45

License Compliance

All dependencies compliant - no copyleft issues detected

Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0

Release v3.9.13

September 23, 2026 · 5 min read

What Changed

Bug Fixes

Security: Python dependency updates in the API imagePicked up the dependency fixes landed on the community lts/1.13.x branch: anyio 4.11.0 → 4.14.2, which clears the critical improper-certificate-validation advisory (CVE-2026-63374) and the unbounded process-pool stderr allocation (CVE-2026-64847); gitpython 3.1.59 → 3.1.62 (CVE-2026-87817 / 87818 / 87819); pypdf 6.15.0 → 6.16.1 (CVE-2026-84309 / 84310 / 84311); soupsieve 2.8.4 → 2.9 (CVE-2026-85999 / 86000); pygments 2.19.2 → 2.20.0; plus a 15-package group bump covering starlette, sentry-sdk, unstructured, numpy, pandas, gevent, pyjwt, yarl, charset-normalizer and others. The default dify-ee-api image now scans with zero critical findings.

Security: Next.js upgraded to 16.3.6 in the Web imageThe community Web image now builds on Next.js 16.3.6 (up from 16.3.4), keeping the LTS line on the current patched framework release. No configuration change is required.

Security: OS-level CVEs cleared by a base-image refreshAll images were rebuilt on refreshed Chainguard base layers, which picks up the fixed zlib (CVE-2026-85091), node-gyp (CVE-2026-84890 / 84933 / 84961), wget (CVE-2026-16599) and glibc (CVE-2026-18374) packages. The Enterprise, Gateway, Audit, Collector, Enterprise Frontend, Web, Plugin Manager, Connector, Controller, Shader and Plugin Daemon images now report no critical and no high findings.

Security Notes

Release scope: dependency and base-image updates onlyThis is a security-maintenance release. The Enterprise services (0.16.x), Enterprise Frontend, plugin daemon and sandbox are built from the same source commits as 3.9.12 — only the community application (lts/1.13.x) moved forward, and only for dependency upgrades. There are no functional changes, no database migrations and no configuration changes in this release.

Security: setuptools / msgpack CVEs do not affect runtimeThe setuptools and msgpack CVEs flagged by this release's scanner are introduced by dependencies vendored inside the base image's system pip (pip/_vendor). They are not installed in the application virtualenv nor imported by the runtime (which uses uv-managed venvs), so they are not exploitable. The assessment is unchanged from 3.9.12 and covers the same three advisories; see the VEX (Vulnerability Exploitability eXchange) document linked in the Security & CVE section for the full details.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for rolling update

Review the manifest changes before applying: helm diff upgrade dify dify-ee/dify --version 3.9.13 -f values.yaml (helm-diff plugin), or render with helm template dify dify-ee/dify --version 3.9.13 -f values.yaml and compare it against helm get manifest dify

Zero-downtime rolling upgrade supported

Upgrade Command

# Back up the database and review the manifest diff first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.9.13

Rollback

$ helm rollback dify 0

Security & CVE

Security vulnerabilities found in this release.0 Critical · 19 High CVE across all container images

Image

critical

high

medium

low

Status

FAIL

PASS

FAIL

PASS

FAIL

PASS

FAIL

PASS

ScannerDocker Scout

Scanned

Sep 23, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

161.19

MIN

127

MAX

519

P50

145

P90

159

P95

164.8

Connections

Max Concurrent

Avg Active

9.8

Empty Workflow QPS

Max QPS

Avg QPS

26.85

Avg Duration (ms)

408.15

License Compliance

All dependencies compliant - no copyleft issues detected

Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0

Release v3.9.12

September 10, 2026 · 6 min read

What Changed

New Features

Web App: Configurable Markdown form field name lengthThe Markdown form field-name length limit was hard-coded to 128 characters, which rejected longer field names in generated forms. It is now configurable through MARKDOWN_FORM_FIELD_NAME_MAX_LENGTH (Docker) / NEXT_PUBLIC_MARKDOWN_FORM_FIELD_NAME_MAX_LENGTH (Web), still defaulting to 128 with the existing character validation intact. (CUS-1603)

Bug Fixes

Studio: Creating an app from a template returns 404Creating an app from a template on the Studio page navigated to /console/api/apps/null and failed with a 404, because the pending template import was not carried over from the app list. Template imports are now handled correctly and app creation succeeds. (ENG-827)

Plugins: Scheduled auto-upgrade silently failsThe plugin auto-upgrade task called the daemon's upgrade endpoint directly without downloading the new package from the marketplace and uploading it first, so the daemon could not find the package and the upgrade failed silently while the task reported success. Auto-upgrade now uses the same download → upload → upgrade path as the console "Upgrade" button. (ENG-829)

SSO: OIDC login fails when userinfo returns no emailOIDC sign-in failed for providers whose userinfo endpoint does not return an email claim. The login flow now falls back to reading the email from the id_token. (ENG-832)

Knowledge Base: Postgres deadlock under concurrent retrievalConcurrent retrieval requests updating overlapping document_segments hit counts could acquire row locks in different orders and fail with a PostgreSQL deadlock (SQLSTATE 40P01). Target rows are now locked in a consistent order and the retrieval-statistics transaction is retried on deadlock; retrieval results and ranking are unchanged. (ENG-834)

Knowledge Base: Attachment files left in storage after segment deletionDeleting an indexed segment from a multimodal knowledge base removed the database records and vector entry but left the physical attachment object in the storage backend, silently consuming space. Attachment objects are now deleted from storage after the database transaction commits, while attachments still referenced by another segment are preserved. (ENG-835)

Weaviate: Vectors overwriting each other and orphaned objects left behindWeaviate object UUIDs were derived from the page content, so segments with identical content overwrote one another, and deletions keyed by index_node_id left orphaned vectors behind. New writes now use doc_id as the canonical object UUID, and a backward-compatible cleanup pass removes legacy content-derived objects on delete. No migration is required. (ENG-836)

Tencent VectorDB: Summary generation fails and blocks a workerTencent VectorDB rejects boolean values in JSON metadata, so the is_summary marker made summary vector upserts fail; the failure path then opened a second database session against a row still locked by the caller, leaving the task stuck and occupying a worker slot. The marker is now stored as an integer for Tencent VectorDB only, and vectorization errors are recorded in the caller-owned session.

Security: Dependency updates across API, Web and Enterprise imagesBumped transformers, unstructured, gitpython, nltk and sharp in the community images, Next.js to 16.3.4 in the Enterprise frontend, and gRPC to 1.83.2 plus x/crypto to 0.56.0 in the Enterprise services, resolving the associated CVEs. See the Security & CVE section below for the current scan results.

Security Notes

Security: setuptools / msgpack CVEs do not affect runtimeThe setuptools and msgpack CVEs flagged by this release's scanner are introduced by dependencies vendored inside the base image's system pip (pip/_vendor). They are not installed in the application virtualenv nor imported by the runtime (which uses uv-managed venvs), so they are not exploitable. The assessment is unchanged from 3.9.11 and covers the same three advisories; see the VEX (Vulnerability Exploitability eXchange) document linked in the Security & CVE section for the full details.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for rolling update

Review the manifest changes before applying: helm diff upgrade dify dify-ee/dify --version 3.9.12 -f values.yaml (helm-diff plugin), or render with helm template dify dify-ee/dify --version 3.9.12 -f values.yaml and compare it against helm get manifest dify

Zero-downtime rolling upgrade supported

Upgrade Command

# Back up the database and review the manifest diff first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.9.12

Rollback

$ helm rollback dify 0

Security & CVE

Security vulnerabilities found in this release.1 Critical · 45 High CVE across all container images

Image

critical

high

medium

low

Status

FAIL

PASS

ScannerDocker Scout

Scanned

Sep 21, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

152

MIN

121

MAX

506

P50

135

P90

146

P95

153.5

Connections

Max Concurrent

Avg Active

10.5

Empty Workflow QPS

Max QPS

25.4

Avg QPS

23.95

Avg Duration (ms)

208.22

License Compliance

All dependencies compliant - no copyleft issues detected

Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0

Release v3.9.11

August 27, 2026 · 6 min read

What Changed

Bug Fixes

Content Moderation: Chat hangs indefinitely when moderation is triggeredWhen content moderation flagged a message, the streamed response could hang forever with no way to stop it, blocking further questions. Workflow execution error handling was fixed so the response now terminates cleanly on a moderation hit. (ENG-764)

HTTP Node: Garbled non-ASCII (e.g. Chinese) response textThe HTTP Request node auto-detected the response encoding and could misread UTF-8 payloads, garbling Chinese characters even when a charset was set. It now honors the charset declared in the response Content-Type header before falling back to detection. (ENG-767)

LLM Node: Model search returns no resultsSearching for a model in the LLM node settings returned empty results because the keyword had to match both the provider and the model name simultaneously. The filter now matches when the keyword hits either field. (ENG-772)

Conversations: "Annotated" filter returns 500Filtering conversations by annotation_status=annotated triggered a PostgreSQL error ("could not identify an equality operator for type json") because the query attempted a full-row DISTINCT over a JSON column. The query was corrected so the annotated filter now works. (ENG-776)

Workflow: Variable Aggregator group toggle not clickableClicking the "aggregate groups" switch in the Variable Aggregator node did nothing and logged "Cannot read properties of undefined (reading 'groups')" when advanced_settings was empty. The node now handles the empty case so the toggle works. (ENG-785)

Workflow: Runs stuck permanently "running" after a Redis blipA transient broker/Redis disconnect during stop checks raised a broken-pipe error, leaving the Workflow Run and its node in "running" forever while the Celery task reported success. Broken-pipe errors during workflow and app stop checks are now ignored so runs converge to a terminal state. (ENG-787)

Knowledge Base: Search fails with "cannot extract elements from a scalar"Knowledge base retrieval could fail with a "cannot extract elements from a scalar" error. The upstream fix has been backported to the LTS line, restoring normal search. (ENG-804)

Document Extraction: .msg files fail to parse in offline environmentsParsing .msg files required the en_core_web_sm spaCy model, which the API image downloaded from GitHub at first use — failing with a timeout in air-gapped or restricted-network deployments. The model is now preinstalled in the image via the Dockerfile, so .msg extraction works offline without any additional network access. (ENG-768)

Explore: App details page errors out for trial appsOpening an app's details from the Explore section could throw an error for trial (TRIAL_APP) apps, breaking the page. The details button is now hidden so the erroring page can no longer be reached. (ENG-773)

Security Notes

Security: setuptools / msgpack CVEs do not affect runtimeThe setuptools and msgpack CVEs flagged by this release's scanner are introduced by dependencies vendored inside the base image's system pip (pip/_vendor). They are not installed in the application virtualenv nor imported by the runtime (which uses uv-managed venvs), so they are not exploitable. See the VEX (Vulnerability Exploitability eXchange) document linked in the Security & CVE section for the full exploitability assessment.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for rolling update

Zero-downtime rolling upgrade supported

Upgrade Command

# Back up database first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.9.11

Rollback

$ helm rollback dify 0

Security & CVE

Security vulnerabilities found in this release.0 Critical · 18 High CVE across all container images

Image

critical

high

medium

low

Status

FAIL

PASS

FAIL

PASS

FAIL

PASS

FAIL

PASS

ScannerDocker Scout

Scanned

Aug 27, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

pip-vendored.openvex.json

VEX (Vulnerability Exploitability eXchange) documents record why the flagged CVEs are not exploitable in Dify Enterprise.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

153.79

MIN

116

MAX

557

P50

133

P90

150.8

P95

159.5

Connections

Max Concurrent

Avg Active

17.4

Empty Workflow QPS

Max QPS

38.6

Avg QPS

37.88

Avg Duration (ms)

106.53

License Compliance

All dependencies compliant - no copyleft issues detected

Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0

Release v3.12.1

August 14, 2026 · 8 min read

What Changed

New Features

Helm: External Secrets Operator SupportChart-generated Kubernetes Secrets can now be replaced with ExternalSecret resources, so credentials live in your own secret manager — Vault, AWS Secrets Manager, or any External Secrets Operator provider — rather than in values.yaml. Set global.externalSecret.enabled and point secretStoreRef at a SecretStore or ClusterSecretStore: every component the chart would otherwise create a Secret for is then pulled from a single remote key and refreshed hourly, and the chart stops rendering its own Secrets. Disabled by default, and it requires the External Secrets Operator to be installed in the cluster.

Helm: Sandbox Security Context ConfigurationNew sandbox.securityContext and sandbox.podSecurityContext chart values. On clusters that drop Linux capabilities — restricted Pod Security Standards or hardened runtimes — Code nodes failed with "operation not permitted" because Dify Sandbox calls chroot() and requires SYS_CHROOT. The capability can now be granted through values. Nothing is granted by default; evaluate it against your own security policy before enabling.

License: Console Expiry Badge Can Be HiddenA new ENABLE_LICENSE_EXPIRY_NOTICE setting (default enabled) controls whether the license expiry countdown badge appears next to the workspace name in the console. Disabling it affects display only — license status and all enforcement behavior are unchanged.

Bug Fixes

Security: Plugin Installation Policy Could Be Bypassed by RetryingUnder a restricted Allowed Plugins policy, upgrading an already-installed plugin was rejected on the first attempt and succeeded on the second. The scope check ran only after the package had been fetched, so the first attempt populated a cache that the second attempt then used to skip validation entirely. Every install and upgrade path now validates the installation scope before the package is fetched.

Security: CVE Remediation Across Enterprise ImagesDependency updates and a Go toolchain bump across the enterprise images clear the advisories that could be remediated at build time, including Go standard library, go-git, gRPC and golang.org/x/text issues. A small number remain where no upstream fix has yet been published. The Security & CVE section below is generated from the release scan and lists the current per-image results.

Knowledge Base: Inconsistent Default Access When Created With a DocumentWith RBAC enabled, a knowledge base created together with its first document defaulted to private, while one created empty defaulted to "All members" — so the same action produced different access depending on how it was started. Both paths now default to "All members". Existing knowledge bases are unaffected.

Knowledge Base: External Knowledge Base Creation FailsConnecting an external knowledge base failed with "Missing dataset_id or pipeline_id in request path". The enterprise permission check required a knowledge base ID that cannot exist while one is being created. Creation now succeeds.

Agent: Attachments Dropped on Models Without Vision SupportFiles attached in the Agent preview were silently discarded before the request reached the agent whenever the selected model had no vision support. The upload appeared to succeed but the agent never received the file. Affected all file types, including spreadsheets, PDFs, and documents.

RBAC: Owner Role Displayed an Incomplete Permission ListThe workspace Owner rendered as holding 6 of 16 application permissions in the console. The Owner has always had full access — only the displayed permission set was wrong. All 16 are now listed.

Workspace: Ownership Transfer Could Leave Two OwnersTransferring workspace ownership appended the owner role to the recipient rather than replacing their existing roles, leaving them with a mix of roles. Transfers made through the admin API did not update RBAC at all, which could leave the previous owner still holding the owner role and block every later transfer. Both paths now leave exactly one owner.

Plugin Credentials: Fields Cleared When Switching Plugin VersionChanging the version of a configured credential plugin cleared every field in the form. Required fields had to be re-entered, and optional ones such as endpoint URL were lost on save without warning. Saved values are now preserved across a version switch.

Helm: Redis Connection String Exposed in ConfigMapsThe composed Redis connection string, which contains the password, was rendered as plaintext into the gateway Caddyfile ConfigMap and the enterprise collector ConfigMap. Both now read it from a Secret, keeping the credential out of anything that can read ConfigMaps and out of GitOps diffs.

Helm: Redis Usernames Containing URL Delimiters Failed to AuthenticateThe Celery broker URL encoded the password but not the username, so a username containing a character such as a colon, slash, hash, or question mark was misparsed — silently authenticating as a different user or as none at all. Usernames are now encoded correctly.

License: Expiry Badge Wording and Remaining DaysThe admin dashboard license badge now shows the days remaining directly instead of only on hover. In Japanese, an expiring license and an already-expired one both displayed as 期限切れ, making them indistinguishable; they now read differently and the remaining-days string renders as a proper sentence.

Observability: Continuous OpenTelemetry Context Detach ErrorsWith ENABLE_OTEL turned on, the API logged "Failed to detach context" continuously under concurrent load, caused by a known defect in the OpenTelemetry Flask instrumentation detaching the same context token twice. Requests were never affected; trace context is now recorded correctly and the log noise is gone.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for rolling update

No migration or manual step is required — this release can be applied directly on top of 3.12.0

If your Redis username contains a colon, slash, hash, or question mark, it was previously misparsed; confirm the account it authenticates as after upgrading

On clusters that drop Linux capabilities, Code nodes need sandbox.securityContext with SYS_CHROOT added — see New Features

Zero-downtime rolling upgrade supported

Upgrade Command

# Back up database first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.12.1

Rollback

$ helm rollback dify 0

Security & CVE

Security vulnerabilities found in this release.0 Critical · 31 High CVE across all container images

critical

high

medium

low

Status

FAIL

PASS

FAIL

PASS

FAIL

PASS

FAIL

PASS

FAIL

ScannerDocker Scout

Scanned

Aug 14, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

350.92

MIN

161

MAX

1679

P50

177

P90

497.6

P95

1031.1

Connections

Max Concurrent

Avg Active

17.5

Empty Workflow QPS

Max QPS

23.2

Avg QPS

20.6

Avg Duration (ms)

564.66

License Compliance

All dependencies compliant - no copyleft issues detected

Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0

Release v3.9.10

August 13, 2026 · 5 min read

What Changed

Bug Fixes

Form: Markdown form field names support more fullwidth charactersRemoved hard-coded punctuation from the field-name allowlist and added the self-hosted NEXT_PUBLIC_MARKDOWN_FORM_FIELD_NAME_EXTRA_CHARS setting so operators can opt in additional characters such as （）！＊＆－。.;；+=—. Also fixes a Streamdown issue where a stray trailing * was appended when form attributes contained punctuation. (ESQ1-226)

Form: Workspace custom brand logo ignored on human-input formThe HITL/form page hard-coded the Dify logo and ignored the workspace-configured "Powered by" brand image. It now reads the workspace branding configuration and renders the custom logo. (ESQ1-238)

Model: Credential fields cleared when switching model typesCredential schemas can reuse the same variable (e.g. context_size, video_support) across multiple model types. A stale timer from a hidden schema entry could delete the value used by the currently visible sibling, leaving fields empty after switching model types. Values are now preserved per visible schema and video_support consistently restores its default. (ESQ1-242)

OSS: Built-in object storage ignored HTTP Range, breaking plugin installs >5MBThe built-in object storage (server/pkg/oss, used when persistence.type != s3) ignored the Range header and always returned the full object. Kaniko downloads plugin build contexts via parallel ranged GETs (5MB parts), so every part received the full body and corrupted objects larger than one part — plugin installs >5MB failed with EOF. Single-range requests are now handled per RFC 9110 (206/416), restoring normal plugin installation. (ESQ1-234)

Security Notes

Security: CVEs from pip-vendored setuptools / msgpack are non-runtimeThe setuptools and msgpack CVEs flagged in this release's scan are introduced by the latest pip version as vendored dependencies. They cannot be fixed on our side without forking pip. They are not related to runtime behavior — pip does not import pip._vendor.setuptools at runtime. Per the pip maintainers (pypa/pip#14031): "A security issue in a vendored library does not necessarily represent a security issue in pip." These findings are accepted as non-actionable.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for rolling update

Zero-downtime rolling upgrade supported

Upgrade Command

# Back up database first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.9.10

Rollback

$ helm rollback dify 0

Security & CVE

Security vulnerabilities found in this release.0 Critical · 18 High CVE across all container images

Image

critical

high

medium

low

Status

FAIL

PASS

FAIL

PASS

FAIL

PASS

FAIL

PASS

ScannerDocker Scout

Scanned

Aug 13, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

148.5

MIN

119

MAX

571

P50

132

P90

160.1

P95

162

Connections

Max Concurrent

Avg Active

17.2

Empty Workflow QPS

Max QPS

41.4

Avg QPS

39.71

Avg Duration (ms)

154.89

License Compliance

All dependencies compliant - no copyleft issues detected

Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0

Release v3.12.0

July 30, 2026 · 5 min read

What Changed

New Features

Agent Apps: Now Available in Dify EnterpriseDify Agent — introduced in Dify CE 1.16.0 as a new app type with a built-in code/shell sandbox, a skill system for tool/API calls, and an agent roster — are now available in Dify Enterprise. EE adds enterprise-grade sandboxing via the official kubernetes-sigs/agent-sandbox project (sandbox-gateway + agent-runtime, replacing the local Dify Sandbox), a dedicated agent.manage RBAC permission, bearer-token auth between the Dify API and the agent backend, and a Squid-proxied egress lockdown for the sandbox. Kubernetes Agent Sandbox ships disabled by default — see Migration Notes to enable it.

RBAC: New agent.manage Workspace PermissionA dedicated agent.manage permission now gates who can create, edit, and publish Agent apps. Agent apps also gain an enterprise access-control entry point, with newly published agents defaulting to "Specific members within the platform."

Webapp: Option to Disable Public AccessEnterprise admins can now disable public, unauthenticated access to web apps entirely via WEBAPP_PUBLIC_ACCESS_ENABLED. Defaults to the existing open behavior, so no action is required unless you want to lock it down.

Bug Fixes

Plugin Daemon: Fixed Declaration Cache Deadlock Causing Full Plugin OutageFixed a bug in the plugin declaration cache's eviction logic where a size-accounting drift could spin the eviction loop forever while holding its lock, blocking every plugin-related API call (install, list, credential validation) until the daemon was restarted.

Admin Console: RBAC Fixes for Owner Transfer & InvitationsFixed several admin console RBAC issues around workspace owner transfer and join/email invitation guards.

Plugin Management: Backend-Assigned Plugins Not VisibleFixed a bug where plugins assigned to a workspace from the admin backend did not appear when configuring credentials in that workspace until the plugin was also installed from the front end.

Security: CVE Dependency RemediationBumped vulnerable dependencies across components (starlette, soupsieve, cryptography, wandb, grpc, sharp) to close CVEs identified in the pre-release Docker Scout scan.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for the rolling update

This version cannot be skipped: it seeds a new agent.manage RBAC permission automatically on startup (no manual action needed)

If you plan to use Kubernetes Agent Sandbox, install the agent-sandbox controller and CRDs BEFORE upgrading, then set sandboxGateway.enabled: true (see Migration Notes) — otherwise the upgrade will fail creating SandboxTemplate/SandboxWarmPool resources

To lock down public webapp access, set enterprise.webappPublicAccessEnabled: false

Zero-downtime rolling upgrade supported

Upgrade Command

# Back up database first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.12.0

Rollback

$ helm rollback dify 0

Security & CVE

Security vulnerabilities found in this release.2 Critical · 23 High CVE across all container images

critical

high

medium

low

Status

PASS

FAIL

PASS

FAIL

ScannerDocker Scout

Scanned

Jul 31, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

171.42

MIN

152

MAX

194

P50

170.5

P90

185.5

P95

189.6

Connections

Max Concurrent

Avg Active

Empty Workflow QPS

Max QPS

Avg QPS

39.89

Avg Duration (ms)

221.52

License Compliance

All dependencies compliant - no copyleft issues detected

Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0

Release v3.9.9

July 29, 2026 · 4 min read

What Changed

Bug Fixes

Annotation Reply: remove 0.8 score threshold lower boundRemoved the arbitrary 0.8 lower-bound UI limit on the Annotation Reply score threshold, so the value can now be configured across the full 0.00–1.00 range as intended.

Datasource: API-key modal hidden behind settings panelFixed an incorrect z-index on the datasource API-key modal that caused it to be obscured by the settings panel. The modal now renders correctly above the panel.

Security Fixes

Security: SSRF bypass in API tool schema fetchThe API tool schema fetch endpoint used raw httpx.get() instead of ssrf_proxy.get(), bypassing the Squid SSRF proxy and allowing authenticated users to reach internal URLs (cloud metadata, Redis, Postgres). All fetches now route through the SSRF proxy. (GHSA-gfmc-xc6g-q7g2)

Security: CVE remediationRemediated one high-severity CVE (CVE-2026-40898) and two medium-severity CVEs (CVE-2026-6993, CVE-2026-41178) affecting the plugin-daemon, gateway, enterprise, and enterprise-audit images. See the Security CVE section below for detailed scan results.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for rolling update

Zero-downtime rolling upgrade supported

Upgrade Command

# Back up database first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.9.9

Rollback

$ helm rollback dify 0

Security & CVE

Security vulnerabilities found in this release.0 Critical · 0 High CVE across all container images

Image

critical

high

medium

low

Status

PASS

ScannerDocker Scout

Scanned

Jul 29, 2026

Data Source

Docker

CVEs for the opt-in api-insecure image is excluded from the CVE table above.

Benchmark Report

TTFE – Time To First Event (ms)

AVG

158.14

MIN

121

MAX

531

P50

141

P90

159.6

P95

189.8

Connections

Max Concurrent

Avg Active

10.7

Empty Workflow QPS

Max QPS

26.2

Avg QPS

25.02

Avg Duration (ms)

243.44

License Compliance