DIFY · CVE-2026-123135 · AI agents & MCP
NO FIX YET
Dify's code-execution sandbox (langgenius/dify-sandbox) authenticates requests with an X-Api-Key whose shipped default is the public string "dify-sandbox" (api/configs/feature/__init__.py:115, docker/.env.example, docker-compose.yaml, volumes/sandbox/conf/config.yaml). The reporter shows that anyone who can reach the sandbox with that key can run arbitrary Python on /v1/sandbox/run. The official docker-compose.middleware.yaml publishes host port 8194; the default docker-compose.yaml does not expose the sandbox. A wrong key gets 401, so authentication works and the weakness is the default value. The reporter found the sandbox isolated from database containers. A public PoC exists. No maintainer response or fix found.
first public Nov 5, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Dify up to version 1.18.0 or 2.0.0-beta.2 and expose its API or sandbox run handler to a network. Hosted or managed Dify installs are the vendor's responsibility, and deployments on a private network with no exposure are at lower risk. The sources do not say which exact configuration enables the sandbox run handler by default.
Not affected if custom-sandbox-key, default-compose-only, managed-hosting, newer-version, sandbox-port-not-exposed
Who cares ai-apps, dify, docker, hardcoded-credentials, python, self-hosted
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/init.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.