CVE-2026-93969: aiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentials
A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensuredefaultsuperuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be carried out remotely. The identifier of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9
Event History
Frequently Asked Questions
Which deployments are affected?
The affected product versions are aiyiyi121 SxDevOps 1.0 and 1.1. The issue is in the ensure_default_superuser function in rbac/services.py.
Does exploitation require credentials or user interaction?
The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. The vulnerability is described as remotely exploitable.
What is the recommended remediation?
Apply the vendor patch identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9. A fixed version was released, but the provided information does not identify its version number.