Skip to content
Threat Feed
Subscribe

Product

Dify

3 briefs RSS
high advisory

Dify MyScale Backend SQL Injection Vulnerability (CVE-2026-61461)

A high-severity SQL injection vulnerability, CVE-2026-61461, exists in the MyScale vector store backend of Dify versions prior to 1.16.0-rc1, allowing attackers with low privileges to execute arbitrary SQL commands via unsanitized search parameters, leading to unauthorized data manipulation in the underlying ClickHouse database.

Dify sql-injection web-vulnerability clickhouse
1r 4t 1c
high threat

Dify Path Traversal Vulnerability (CVE-2026-41948)

Dify version 1.14.1 and prior contain a path traversal vulnerability (CVE-2026-41948) that allows authenticated users to manipulate requests to the Plugin Daemon's internal REST API and access internal endpoints by traversing out of their authorized tenant path.

Dify +1 path-traversal privilege-escalation cloud
2r 1t 1c
high advisory

Dify Authorization Bypass Vulnerability (CVE-2026-41947)

Dify version 1.14.1 and prior contains an authorization bypass vulnerability (CVE-2026-41947) that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership, potentially leading to information disclosure by redirecting application messages to attacker-controlled LLM trace providers.

Dify +1 authorization-bypass privilege-escalation cve-2026-41947
2r 1t 1c