Potheeswaran 
Dify has patched a high-severity SQL injection vulnerability affecting its MyScale vector store backend and is warning users on versions earlier than 1.16.0-rc1 to update.
Tracked as CVE-2026-61461, the issue could allow an authenticated attacker to inject and execute arbitrary SQL statements through a full-text search function.
The vulnerability received a CVSS v4 score of 8.7 and is classified as CWE-89, or improper neutralization of special elements in an SQL command.
Dify SQL Injection Flaw
The issue resides in Dify’s search_by_full_text method when the platform uses the MyScale vector store backend. According to the disclosure, search parameters passed to this method were incorporated into SQL queries without adequate escaping or parameterization.
An attacker with the required application-level privileges could supply specially crafted search input that alters the intended database query. Because MyScale is built on ClickHouse, successful exploitation could enable unauthorized access to data stored in the connected ClickHouse database.
Potential consequences include reading sensitive records, modifying stored information, or deleting data. The advisory’s CVSS vector indicates that the attack can be performed remotely, with low complexity, and requires low privileges, with no user interaction required.
Vector databases have become a core component of AI application stacks, often storing embeddings, document metadata, retrieval context, and information connected to enterprise knowledge bases.
Although embeddings may not always reveal original documents directly, associated metadata and retrieved content can carry sensitive business, customer, or operational information.
In this case, the risk does not stem from the semantic-search concept itself but from unsafe query construction in the integration layer that connects Dify to the database.
“AI platforms are rapidly expanding the number of paths into enterprise data stores. A search box that appears harmless at the application layer can become a database-level attack surface when developers treat user input as trusted SQL.
Dify addressed the vulnerability in release 1.16.0-rc1. The remediation is documented in a project pull request and a patch commit that modified the affected MyScale vector store query handling.
Organizations running Dify with MyScale should identify all deployments below the fixed release, particularly environments where the platform connects to ClickHouse instances containing production data. Teams should upgrade to a patched version as soon as their change-management processes permit.
Administrators should also review application accounts and database permissions. The vulnerable path requires privileges, so limiting Dify user access and applying least-privilege controls can reduce exposure before and after patching.
Mitigations
Security teams should take the following steps:
- Upgrade Dify to 1.16.0-rc1 or a later supported release containing the fix.
- Determine whether MyScale vector store support is enabled in affected Dify deployments.
- Review ClickHouse audit logs for unusual full-text search requests, SQL errors, unexpected queries, and unauthorized data changes.
- Rotate database credentials if suspicious activity is identified.
- Restrict database accounts used by Dify to only the permissions essential for normal operations.
- Review other vector store connectors and custom integrations for string-built database queries.
The public release notes, researcher disclosure, pull request, and patch commit provide technical details for defenders validating the update. Given the potential for data theft or destructive database actions, organizations using the affected integration should treat CVE-2026-61461 as a priority patching issue.
About the Author
