CVE-2026-123135
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
61/100
Published: 2026-11-05
Modified: 2026-11-09
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
AT:
None
VC:
Low
VI:
Low
VA:
Low
Description
A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.
Weakness Classification (2)
Affected Software (44)
| Vendor | Product | Version |
|---|---|---|
| langgenius | dify | 1.0 |
| langgenius | dify | 1.1 |
| langgenius | dify | 1.2 |
| langgenius | dify | 1.3 |
| langgenius | dify | 1.4 |
| langgenius | dify | 1.5 |
| langgenius | dify | 1.6 |
| langgenius | dify | 1.7 |
| langgenius | dify | 1.8 |
| langgenius | dify | 1.9 |
| langgenius | dify | 1.10 |
| langgenius | dify | 1.11 |
| langgenius | dify | 1.12 |
| langgenius | dify | 1.13 |
| langgenius | dify | 1.14 |
| langgenius | dify | 1.15 |
| langgenius | dify | 1.16 |
| langgenius | dify | 1.17 |
| langgenius | dify | 1.18.0 |
| langgenius | dify | 2.0.0-beta.0 |
| langgenius | dify | 2.0.0-beta.1 |
| langgenius | dify | 2.0.0-beta.2 |
| langgenius | dify | 1.0 |
| langgenius | dify | 1.1 |
| langgenius | dify | 1.2 |
| langgenius | dify | 1.3 |
| langgenius | dify | 1.4 |
| langgenius | dify | 1.5 |
| langgenius | dify | 1.6 |
| langgenius | dify | 1.7 |
Showing 30 of 44 entries
References & Advisories (8)
vdb-entry
third-party-advisory
third-party-advisory
signature
permissions-required
product
issue-tracking
patch
issue-tracking
exploit