CVE-2026-123135

MEDIUM 6.3

langgenius dify Sandbox Run init.py hard-coded credentials

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.

CWE	CWE-798 CWE-259
Vendor	langgenius
Product	dify
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for langgenius dify

Be the first to know when new medium vulnerabilities affecting langgenius dify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

langgenius / dify

1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18.0 2.0.0-beta.0 2.0.0-beta.1 2.0.0-beta.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/431443 vuldb.com: https://vuldb.com/vuln/431443/cti vuldb.com: https://vuldb.com/cve/CVE-2026-123135 vuldb.com: https://vuldb.com/submit/1033133 github.com: https://github.com/langgenius/dify/issues/44054 github.com: https://github.com/langgenius/dify/pull/44192 github.com: https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md github.com: https://github.com/langgenius/dify/

Credits

🔍 Ybyu (VulDB User)