CVE-2026-123135
6.3 MEDIUMpublic exploit availablePublished 2026-11-05 · Updated 2026-11-05
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-259, CWE-798
Public exploit & PoC references
All references
- https://github.com/langgenius/dify/
- https://github.com/langgenius/dify/issues/44054
- https://github.com/langgenius/dify/pull/44192
- https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md
- https://vuldb.com/cve/CVE-2026-123135
- https://vuldb.com/submit/1033133
- https://vuldb.com/vuln/431443
- https://vuldb.com/vuln/431443/cti
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-101052PoC
- MEDIUMCVE-2026-105141PoC
- HIGHCVE-2026-105147PoC
- MEDIUMCVE-2026-108584PoC
- MEDIUMCVE-2026-108831
- HIGHCVE-2026-110667PoC
- HIGHCVE-2026-112146PoC
- CRITICALCVE-2026-121609PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.