CVEs / CVE-2026-61461
CVE-2026-61461
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.
Affected products · 1
| Product | Versions affected | Fixed in |
|---|---|---|
| Dify | < 1.16.0 | 1.16.0 |
Versions as NVD's CPE configuration states them; "—" means the record gives no fixed version, not that none exists. Check the vendor's advisory in the references.
In this registry
- Dify — agent dossier
References · 5
- github.com/langgenius/dify/commit/d9884efaeea8322706e24c560d2c17e5bf3fab5f — Patch
- github.com/langgenius/dify/issues/38281 — Issue Tracking
- github.com/langgenius/dify/pull/38295 — Issue Tracking, Patch
- github.com/langgenius/dify/releases/tag/1.16.0-rc1 — Release Notes
- www.vulncheck.com/advisories/dify-rc1-sql-injection-via-myscale-vector-store-search-by-ful — Third Party Advisory
The official record's references, as NVD lists them, minus any tagged Exploit. Nothing here is an exploit or a proof of concept.
Description, scores, versions and references are the official CVE record's own, retrieved 2026-10-26 from NVD. Category, attack surface and cross-links are this registry's classification and can be wrong — use the button above. Not a severity assessment for your deployment.