CVE-2026-61461: Dify Dify SQL Injection Vulnerability

CVE-2026-61461 Overview

CVE-2026-61461 is a SQL injection vulnerability in Dify, an open-source LLM application development platform. The flaw exists in the MyScale vector store backend, where the search_by_full_text method interpolates unsanitized search parameters directly into a ClickHouse SQL query string. Authenticated attackers can inject arbitrary SQL to read, modify, or delete data in the underlying ClickHouse database. The issue affects Dify versions prior to 1.16.0-rc1 and is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Attackers with authenticated access can compromise the confidentiality, integrity, and availability of the ClickHouse vector store through injected SQL commands.

Affected Products

Dify versions prior to 1.16.0-rc1
Deployments using the MyScale vector database backend
Dify component dify:dify (langgenius/dify)

Discovery Timeline

2026-07-10 - CVE-2026-61461 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-61461

Vulnerability Analysis

The vulnerability resides in the MyScale vector store integration at api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py. The search_by_full_text method builds a ClickHouse TextSearch expression using an f-string that embeds the caller-supplied query argument. Because the query string is concatenated into the SQL text without escaping or parameter binding, any single quote or SQL metacharacter breaks out of the string literal and is executed as SQL. Attackers can leverage the injection to exfiltrate embeddings, tamper with retrieval-augmented generation (RAG) data, or drop tables in the ClickHouse backend.

Root Cause

The root cause is direct string interpolation of untrusted input into a SQL query. The pre-patch code used f"TextSearch('enable_nlq=false')(text, '{query}')", which offers no separation between SQL code and user data. Standard parameterization via ClickHouse bound parameters was not applied.

Attack Vector

Exploitation requires network access and a low-privileged authenticated session capable of invoking full-text search on a MyScale-backed knowledge base. The attacker submits a search query containing SQL syntax that terminates the string literal and appends attacker-controlled statements. No user interaction beyond issuing the search request is needed.

python

# Patch diff from api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py
    @override
    def search_by_full_text(self, query: str, **kwargs: Any) -> list[Document]:
-        return self._search(f"TextSearch('enable_nlq=false')(text, '{query}')", SortOrder.DESC, **kwargs)
+        return self._search(
+            "TextSearch('enable_nlq=false')(text, {query:String})",
+            SortOrder.DESC,
+            parameters={"query": query},
+            **kwargs,
+        )

-    def _search(self, dist: str, order: SortOrder, **kwargs: Any) -> list[Document]:
+    def _search(
+        self, dist: str, order: SortOrder, parameters: dict[str, Any] | None = None, **kwargs: Any
+    ) -> list[Document]:
         top_k = kwargs.get("top_k", 4)
         if not isinstance(top_k, int) or top_k <= 0:
             raise ValueError("top_k must be a positive integer")

Source: GitHub Commit d9884ef

The patch replaces the f-string interpolation with a ClickHouse bound parameter ({query:String}) and passes the user value through the parameters dictionary, ensuring proper escaping at the driver level.

Detection Methods for CVE-2026-61461

Indicators of Compromise

ClickHouse query logs containing full-text search calls with unusual quote characters, UNION, SELECT, DROP, or comment sequences (--, /*) in the TextSearch argument.
Unexpected DDL or DML activity originating from the Dify service account against MyScale/ClickHouse tables.
Application logs showing malformed or oversized query parameters submitted to knowledge base full-text search endpoints.

Detection Strategies

Enable ClickHouse query_log and alert on statements whose parameters include SQL metacharacters that reach the TextSearch function.
Instrument the Dify API layer to log full-text search requests along with authenticated user identifiers for correlation.
Compare running Dify version against 1.16.0-rc1 and flag any deployments using the MyScale backend on earlier releases.

Monitoring Recommendations

Forward Dify application logs and ClickHouse query logs to a centralized analytics pipeline for anomaly detection on search parameters.
Baseline normal search_by_full_text query patterns and alert on deviations such as sudden UNION SELECT, schema queries against system.tables, or destructive statements.
Review authentication logs for accounts issuing high volumes of search requests immediately preceding suspicious ClickHouse activity.

How to Mitigate CVE-2026-61461

Immediate Actions Required

Upgrade Dify to version 1.16.0-rc1 or later, which contains the parameterized query fix from pull request #38295.
Restrict network access to the Dify API and MyScale/ClickHouse instances to trusted subnets and authenticated clients only.
Rotate any ClickHouse credentials that may have been exposed through prior exploitation and audit stored vector data for tampering.

Patch Information

The fix is delivered in the Dify 1.16.0-rc1 release via commit d9884efaeea8322706e24c560d2c17e5bf3fab5f. The patch converts the vulnerable f-string into a ClickHouse bound parameter and threads a parameters dictionary through the internal _search helper. Additional context is available in the VulnCheck SQL Injection Advisory and the GitHub issue discussion.

Workarounds

Temporarily switch the vector store backend from MyScale to an unaffected provider until the upgrade can be applied.
Place a web application firewall or reverse proxy in front of the Dify API to block search payloads containing SQL metacharacters such as ', ;, --, and UNION.
Enforce least-privilege database roles for the Dify service account so that any injection is limited to read-only access on the vector tables.

bash

# Verify the installed Dify version and upgrade
docker exec -it dify-api pip show dify | grep -i version

# Pull and deploy the patched release
git fetch --tags
git checkout 1.16.0-rc1
docker compose pull && docker compose up -d