EUVD-2026-42973
GHSA-hw83-q5rh-7hgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege Dify account
-
DeliveryReach MyScale full-text search endpoint
-
ExploitSubmit crafted SQL in search parameter
-
Executionsearch_by_full_text injects into ClickHouse query
-
ImpactRead, modify, or delete vector store data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Dify instance is configured to use the MyScale vector store backend - the vulnerable search_by_full_text path only runs for MyScale/ClickHouse deployments, so instances using any other vector store are not exploitable via this flaw. The attacker also needs a valid authenticated Dify account able to invoke full-text search over a dataset (PR:L), which limits exploitation to users who can register or are provisioned accounts. No victim user interaction and no special client platform are needed (UI:N, AV:N); the request is an ordinary network call. The practical limiting factors are therefore the MyScale-specific configuration and the requirement for a low-privilege authenticated session. |
| Impact | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects network reachability, low attack complexity, and full high impact to confidentiality, integrity, and availability of the vulnerable system, but requires low-level privileges (PR:L) - an authenticated Dify account. Subsequent-system impact is None (SC:N/SI:N/SA:N), so damage is scoped to the MyScale/ClickHouse data store rather than crossing into other systems via a scope change. Real-world priority is raised by publicly available exploit code and a confirmed VulnCheck advisory, but the CVE is NOT in CISA KEV and no EPSS score was provided, so widespread automated exploitation is not confirmed - this reads as a serious but conditional data-tier risk rather than an internet-wide worm. The PR:L requirement is the key limiting factor: in multi-tenant or externally exposed Dify deployments where accounts are easy to obtain, it is a genuine compromise of the vector store; in tightly controlled single-tenant installs the exposure is lower. Note only a CVSS 4.0 vector was supplied (no 3.1), so teams using 3.1-based tooling must map it themselves. |
| Exploit ScenarioDerived | An attacker holding a low-privilege Dify account uses a knowledge-base or dataset full-text search feature and supplies a crafted search string containing SQL syntax. Because search_by_full_text concatenates that input directly into the MyScale/ClickHouse query, the injected SQL executes, letting the attacker dump other tenants' embedded documents or delete records. Public proof-of-concept and exploit code are already available via the VulnCheck advisory and GitHub issue #38281, lowering the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
SQL injection in Dify's MyScale vector store backend (versions before 1.16.0-rc1) lets authenticated attackers execute arbitrary SQL against the underlying ClickHouse database by passing unsanitized search parameters into the search_by_full_text method. Because those parameters are concatenated into the query without escaping or parameterization, an attacker can read, modify, or delete stored vector-store data. Publicly available exploit code exists (VulnCheck advisory and GitHub issue #38281) and a vendor patch is available; there is no confirmation of active in-the-wild exploitation.
RemediationAI
Upgrade to Dify 1.16.0-rc1 or later, which contains the fix (commit d9884efaeea8322706e24c560d2c17e5bf3fab5f, merged via pull request #38295) - Vendor-released patch: 1.16.0-rc1. Because rc1 is a release-candidate tag, organizations with strict change control should track the subsequent stable release but should not delay patching exposed instances. If immediate patching is not possible, the most effective compensating control is to stop using the MyScale vector store backend and migrate to an unaffected store, since the vulnerable code path only runs for MyScale; the trade-off is re-indexing existing knowledge bases into the new store. Additionally, restrict who can obtain Dify accounts and reach search functionality (tighten registration, place the app behind SSO/VPN, and network-restrict the ClickHouse instance) to shrink the PR:L attack surface, accepting that these controls limit legitimate self-service access. Consult the VulnCheck advisory and GitHub issue #38281 for exploit specifics.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dify is an open-source LLM application development platform that supports pluggable vector stores for retrieval-augmented generation. The flaw resides in the MyScale integration, where MyScale is a vector database built on top of ClickHouse. The vulnerable search_by_full_text method constructs a full-text search query by directly interpolating attacker-controlled search parameters into the SQL string instead of using parameterized queries or escaping - the classic root cause captured by CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Any input reaching this method is executed verbatim by ClickHouse, so injected SQL operators, sub-queries, or statement terminators are honored by the database engine.
Know when Dify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable SQL injection with low complexity, but requires an authenticated low-privilege account (PR:L); full CIA impact confined to the ClickHouse data store, so scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.
Executive ViewAI
Dify's MyScale vector store backend contains a high-severity SQL injection vulnerability affecting authenticated users, with publicly available exploit code identified. Attackers can execute arbitrary SQL against underlying ClickHouse databases, enabling unauthorized access, modification, or deletion of vector embeddings and application data. Organizations using Dify for AI application development must prioritize patching to prevent data compromise and potential business disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Dify 1.9.1 permits unauthenticated remote GET requests to the /console/api/system-features console endpoint, letting ano
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Path traversal in Dify versions 0 through 1.14.1 allows authenticated tenants to escape their authorized tenant path and
Cross-tenant authorization bypass in LangGenius Dify versions through 1.14.1 lets any logged-in editor reroute another t
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts
Plaintext exposure of third-party service API keys in Dify prior to version 1.11.0 allows any authenticated non-administ
Cross-tenant document disclosure in Dify 1.14.1 and prior allows any authenticated user to read up to 3,000 characters o
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess a
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an
Dify is an open-source LLM app development platform. Rated high severity (CVSS 7.6), this vulnerability is remotely expl
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. Rated high severity (CVSS 7.5
Exploit-DB