CVE-2026-61461: 
Dify vulnerability analysis and mitigation

CVE-2026-61461 is a SQL injection vulnerability in Dify's MyScale vector store backend affecting all versions before 1.16.0-rc1. The flaw allows authenticated network attackers to execute arbitrary SQL against the underlying ClickHouse database by supplying unsanitized input to the search_by_full_text method. It was reported via GitHub Security Advisories and publicly disclosed on July 10, 2026, with a fix merged on July 2, 2026. The vulnerability carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory, Feedly).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In the vulnerable code, the search_by_full_text method in myscale_vector.py directly interpolates the user-supplied query parameter into a ClickHouse SQL expression using a Python f-string — f"TextSearch('enable_nlq=false')(text, '{query}')" — without any escaping or parameterization. This raw string is then passed to clickhouse_connect.client.query(), allowing an attacker to break out of the string literal and inject arbitrary SQL. The attack is reachable via the Dify API endpoint POST /v1/datasets/{id}/hit-testing when the retrieval method is set to full_text_search (GitHub Issue, GitHub Commit).

Successful exploitation allows any authenticated user to read, modify, or delete data in the ClickHouse database backing the Dify knowledge store, resulting in high confidentiality, integrity, and availability impact. An attacker can exfiltrate sensitive documents and embeddings stored in the vector database, tamper with knowledge base content, or destroy data entirely. Because ClickHouse may store proprietary or user-submitted data, the exposure risk is significant for organizations using Dify as an AI application platform (Github Advisory, Feedly).

A proof-of-concept (PoC) exploit was included in the original GitHub issue report, demonstrating the attack chain using dify_client and clickhouse_connect Python libraries. NVD's SSVC assessment classifies exploitation as "poc" (PoC available). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.36%, placing it in the 28th percentile for exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, GitHub Issue, Feedly).

1. Authenticate to Dify: Obtain valid low-privileged credentials for the target Dify instance (e.g., a standard user account or API key).
2. Identify a dataset using MyScale: Enumerate available datasets via the Dify API or UI to find one backed by the MyScale (ClickHouse) vector store.
3. Craft the malicious payload: Construct a SQL injection string that breaks out of the ClickHouse TextSearch function context, for example: x') AS dist FROM dify.collection_1 UNION ALL SELECT secret FROM users --
4. Send the injection request: Submit a POST request to /v1/datasets/{dataset_id}/hit-testing with the payload in the query field and search_method set to full_text_search:

{
  "query": "x') AS dist FROM dify.collection_1 UNION ALL SELECT secret FROM users --",
  "retrieval_model": { "search_method": "full_text_search" }
}

5. Observe results: The injected SQL is executed by ClickHouse and results are returned in the API response, exposing data from arbitrary tables (GitHub Issue, GitHub Commit).

• Network: Unusual or repeated POST requests to /v1/datasets/{id}/hit-testing with search_method: full_text_search and anomalous query values containing SQL metacharacters (e.g., ', --, UNION, SELECT).
• Logs: Dify API access logs showing hit-testing requests with query strings containing SQL keywords or injection patterns; ClickHouse query logs recording unexpected UNION ALL, SELECT, or multi-statement queries originating from the Dify service account.
• Database: Unexpected read access to tables outside the normal vector store schema (e.g., user or configuration tables) in ClickHouse query history logs (GitHub Issue).

The fix is included in Dify version 1.16.0-rc1 and later, where the vulnerable f-string interpolation was replaced with ClickHouse parameterized query syntax ({query:String} with a parameters dict passed to client.query()). Organizations should upgrade to 1.16.0-rc1 or any subsequent stable release immediately. As a temporary workaround until patching is possible, restrict network access to the Dify application to trusted users only and monitor ClickHouse query logs for anomalous SQL patterns (GitHub Commit, Dify Release).

The vulnerability was originally reported through GitHub Security Advisories approximately two months before public disclosure, but the reporter noted receiving no response during that period, prompting them to file a public GitHub issue. The fix was reviewed and merged by Dify maintainers within one day of the public issue being filed. A maintainer (QuantumGhost) noted in the PR review that additional f-string SQL construction in the _search method may warrant further migration to a query builder, suggesting ongoing security hardening efforts (GitHub Issue, GitHub PR).