TI-2026-85599 Aliases CVE-2026-123135 GHSA-4w83-mp5v-8r97

Hard-coded credentials in langgenius dify Sandbox Run handler

LOW 23CWE-259Published 2026-11-05 · Updated 2026-11-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-259.

Summary

The Sandbox Run handler in langgenius dify up to 1.18.0 and 2.0.0-beta.2 contains hard-coded credentials in api/configs/feature/__init__.py (CWE-798). A remote attacker with low privileges can exploit this flaw. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.

Why it matters now

EPSS 0.00214 11th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
langgenius	dify	1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18.0; 2.0.0-beta.0; 2.0.0-beta.1; 2.0.0-beta.2	—	No fix listed	CNA

dify Vendorlanggenius Affected 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18.0; 2.0.0-beta.0; 2.0.0-beta.1; 2.0.0-beta.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:langgenius:dify::::::::	—	—	langgenius

cpe:2.3:a:langgenius:dify:*:*:*:*:*:*:*:* Versions — — ·langgenius

Remediation

The sources list no fixed version for langgenius dify.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

2026-11-05 Threatist record created from CVE-2026-123135
2026-11-05 Alias added: GHSA-4w83-mp5v-8r97

References

Exploit 1

https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md

Patch 1

https://github.com/langgenius/dify/pull/44192

Other 2

TI-2025-35265 Default credentials in Dify thru 1.5.1. CVSS 3.1CRITICAL 9.8
TI-2026-30343 Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints CVSS 4.0CRITICAL 9.3
TI-2026-68373 Unauthenticated server-side request forgery in Dify remote file upload CVSS 3.1HIGH 8.3
TI-2026-30344 Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access CVSS 4.0CRITICAL 9.3
TI-2026-44066 Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text CVSS 4.0HIGH 8.7
TI-2025-03045 Unsanitized Input in langgenius/dify CVSS 3.1HIGH 7.2

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences