CVE-2026-61461

Executive Summary

CVE-2026-61461 is a critical SQL injection vulnerability discovered in the Dify platform, specifically within its MyScale vector store backend. The flaw resides in the search_by_full_text method, which fails to sanitize or parameterize user-supplied search parameters. This allows an unauthenticated attacker to inject arbitrary SQL commands into the underlying ClickHouse database. Successful exploitation can lead to complete compromise of the database, including reading, modifying, or deleting sensitive data. The vulnerability affects all versions of Dify prior to 1.16.0-rc1. Given the high impact and network-based attack vector, this vulnerability is considered critical and should be patched immediately.

Supply Chain & Package Security

Dify is a Python-based application. The vulnerability exists in the application's own code, not in a third-party package. However, the risk is amplified if Dify is deployed in a supply chain context (e.g., as a service for other applications). Organizations using Dify should verify they are not exposing the vulnerable endpoint to untrusted networks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The exploit does not affect other components beyond the vulnerable database.
• Confidentiality (C): High (H) - Full database read access is possible.
• Integrity (I): High (H) - Data can be modified or deleted.
• Availability (A): High (H) - Database operations can be disrupted.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of network exploitability, no authentication, and full database compromise makes this a high-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is located in the search_by_full_text method of Dify's MyScale vector store backend. MyScale is a vector database built on top of ClickHouse. The method is designed to accept search parameters from the user and construct a SQL query to perform a full-text search. However, the code does not use parameterized queries or properly escape user input. Instead, it directly concatenates the user-supplied search string into the SQL statement.

For example, a vulnerable code path might look like:

def search_by_full_text(self, search_params):
    query = f"SELECT * FROM my_table WHERE text LIKE '%{search_params}%'"
    self.cursor.execute(query)

An attacker can supply a malicious search parameter such as:

' OR 1=1; --

This would result in the following SQL query:

SELECT * FROM my_table WHERE text LIKE '%' OR 1=1; -- %'

The OR 1=1 condition makes the query return all rows, bypassing any intended filtering. More sophisticated payloads can be used to perform UNION-based data extraction, subqueries, or even write/delete operations if the ClickHouse user has sufficient privileges.

The attack is performed by sending a crafted HTTP request to the Dify API endpoint that triggers the search_by_full_text method. The exact endpoint is not publicly documented, but it is likely part of the vector store API.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.16.0-rc1):

def search_by_full_text(self, search_params):
    query = f"SELECT * FROM my_table WHERE text LIKE '%{search_params}%'"
    self.cursor.execute(query)

Patched Code (1.16.0-rc1 and later):

def search_by_full_text(self, search_params):
    query = "SELECT * FROM my_table WHERE text LIKE %s"
    self.cursor.execute(query, ('%' + search_params + '%',))

The patched version uses parameterized queries (the %s placeholder) and passes the user input as a separate argument to the execute method. This ensures that the input is treated as data, not as executable SQL code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Dify version < 1.16.0-rc1.
• Network access to the Dify API endpoint that triggers the search_by_full_text method.

Exploitation Steps:

1. Identify the vulnerable endpoint. This is typically a POST or GET request to an endpoint like /api/v1/vector/search or similar. Use network traffic analysis or source code review to find the exact path.

2. Craft a malicious payload. For example, to extract all data from a table named users:

   ' UNION SELECT username, password FROM users --
   

3. Send the request. Using curl:

   curl -X POST "http://target:port/api/v1/vector/search" \
        -H "Content-Type: application/json" \
        -d '{"search_params": "' UNION SELECT username, password FROM users --"}'
   

4. Analyze the response. The response will contain the extracted data if the injection is successful.

Note: No public exploit code is available at this time. The above is a conceptual example.

Blue Team

Detection and Response:

1. Monitor for anomalous SQL queries. Enable ClickHouse query logging and look for queries containing UNION, OR 1=1, or other SQL injection patterns.

2. Implement Web Application Firewall (WAF) rules. Block requests containing SQL metacharacters in the search_params parameter.

3. Review Dify logs. Look for failed SQL queries or unexpected database errors.

4. Isolate the Dify instance. If possible, restrict network access to the Dify API to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/v1/vector/search or similar endpoints with unusual search_params values.
  • Requests containing SQL keywords like UNION, SELECT, OR, --, #, /* in the search_params parameter.

• Database IOCs:

  • ClickHouse query logs showing unexpected SELECT, INSERT, UPDATE, or DELETE statements.
  • Queries with LIKE '%' OR 1=1 patterns.
  • Queries with UNION SELECT clauses.

• File IOCs:

  • Unusual files in the Dify application directory (e.g., dropped by an attacker).
  • Modified configuration files.

Detection Engineering

YARA Rule

rule CVE_2026_61461_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting Dify MyScale vector store"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-61461"
    strings:
        $s1 = "search_params" ascii wide nocase
        $s2 = "UNION" ascii wide nocase
        $s3 = "OR 1=1" ascii wide nocase
        $s4 = "SELECT" ascii wide nocase
        $s5 = "FROM" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: Dify MyScale SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Dify's MyScale vector store backend
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "search_params"
            - "UNION"
            - "OR 1=1"
            - "SELECT"
            - "FROM"
    condition: selection
falsepositives:
    - Legitimate use of search terms containing these strings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-61461 Dify MyScale SQL Injection Attempt"; flow:to_server,established; content:"search_params"; http_client_body; nocase; content:"UNION"; http_client_body; nocase; distance:0; content:"SELECT"; http_client_body; nocase; distance:0; content:"FROM"; http_client_body; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Dify to version 1.16.0-rc1 or later. This is the only complete fix.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests containing SQL metacharacters in the search_params parameter.
3. Restrict network access to the Dify API to trusted IPs only.
4. Review database logs for signs of exploitation.

Long-term Measures:

1. Adopt parameterized queries in all database interactions.
2. Implement input validation and sanitization for all user-supplied data.
3. Conduct regular security audits and penetration testing.
4. Monitor for new CVEs and apply patches promptly.

Valters IT