CVE-2026-61461: Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the searchbyfulltext method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61461?
The severity of CVE-2026-61461 is high, with a CVSS score of 8.8.
How do I fix CVE-2026-61461?
To fix CVE-2026-61461, update Dify to version 1.16.0-rc1 or later.
What vulnerability type is CVE-2026-61461?
CVE-2026-61461 is classified as a SQL Injection vulnerability.
What impact does CVE-2026-61461 have on data security?
CVE-2026-61461 allows attackers to execute arbitrary SQL queries, potentially compromising data integrity and confidentiality.
Can CVE-2026-61461 be exploited remotely?
Yes, CVE-2026-61461 can be exploited remotely due to its application vulnerability in the MyScale vector store backend.