Which versions of Dify are affected by CVE-2026-61461?

Dify's MyScale vector store backend contains a high-severity SQL injection vulnerability affecting authenticated users, with publicly available exploit code identified.. A patch is available.

Is there a public PoC exploit available for CVE-2026-61461?

Yes, a public proof-of-concept exploit is available for CVE-2026-61461. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-61461?

Within 24 hours: Identify all Dify instances with MyScale backend enabled and review ClickHouse access logs for anomalous SQL activity. Within 7 days: Test and validate upgrade to Dify 1.16.0-rc1 in a non-production environment. Within 30 days: Deploy the patched version to all production Dify deployments.

Dify CVE-2026-61461

Q: What is the CVSS score of CVE-2026-61461?

CVE-2026-61461 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42973 HIGH

SQL Injection (CWE-89)

2026-07-10 VulnCheck

GHSA-hw83-q5rh-7hgf

SQLi Dify

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable SQL injection with low complexity, but requires an authenticated low-privilege account (PR:L); full CIA impact confined to the ClickHouse data store, so scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 18:51 vuln.today

DescriptionCVE.org

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

AnalysisAI

SQL injection in Dify's MyScale vector store backend (versions before 1.16.0-rc1) lets authenticated attackers execute arbitrary SQL against the underlying ClickHouse database by passing unsanitized search parameters into the search_by_full_text method. Because those parameters are concatenated into the query without escaping or parameterization, an attacker can read, modify, or delete stored vector-store data. Publicly available exploit code exists (VulnCheck advisory and GitHub issue #38281) and a vendor patch is available; there is no confirmation of active in-the-wild exploitation.

Technical ContextAI

Dify is an open-source LLM application development platform that supports pluggable vector stores for retrieval-augmented generation. The flaw resides in the MyScale integration, where MyScale is a vector database built on top of ClickHouse. The vulnerable search_by_full_text method constructs a full-text search query by directly interpolating attacker-controlled search parameters into the SQL string instead of using parameterized queries or escaping - the classic root cause captured by CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Any input reaching this method is executed verbatim by ClickHouse, so injected SQL operators, sub-queries, or statement terminators are honored by the database engine.

RemediationAI

Upgrade to Dify 1.16.0-rc1 or later, which contains the fix (commit d9884efaeea8322706e24c560d2c17e5bf3fab5f, merged via pull request #38295) - Vendor-released patch: 1.16.0-rc1. Because rc1 is a release-candidate tag, organizations with strict change control should track the subsequent stable release but should not delay patching exposed instances. If immediate patching is not possible, the most effective compensating control is to stop using the MyScale vector store backend and migrate to an unaffected store, since the vulnerable code path only runs for MyScale; the trade-off is re-indexing existing knowledge bases into the new store. Additionally, restrict who can obtain Dify accounts and reach search functionality (tighten registration, place the app behind SSO/VPN, and network-restrict the ClickHouse instance) to shrink the PR:L attack surface, accepting that these controls limit legitimate self-service access. Consult the VulnCheck advisory and GitHub issue #38281 for exploit specifics.