CVE-2026-123135: langgenius dify Sandbox Run __init__.py hard-coded credentials
A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/init.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.
Event History
Frequently Asked Questions
Which deployments are affected?
langgenius dify versions up to 1.18.0 and 2.0.0-beta.2 are identified as affected. The issue is associated with the Sandbox Run Handler and the api/configs/feature/__init__.py file.
What access does an attacker need?
The vulnerability can be attacked remotely and requires low privileges. No user interaction is required.
Is exploitation practical?
A public exploit is available, and the exploit maturity is rated as proof-of-concept. The reported impact includes low confidentiality, integrity, and availability effects.