{"id":"CVE-2026-123135","kind":"vulnerability","aliases":["CVE-2026-123135"],"related":[],"title":"Dify: sandbox ships with public default API key \"dify-sandbox\", allowing code execution if port 8194 is reachable","description":"A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.","summary":"Dify's code-execution sandbox (langgenius/dify-sandbox) authenticates requests with an X-Api-Key whose shipped default is the public string \"dify-sandbox\" (api/configs/feature/__init__.py:115, docker/.env.example, docker-compose.yaml, volumes/sandbox/conf/config.yaml). The reporter shows that anyone who can reach the sandbox with that key can run arbitrary Python on /v1/sandbox/run. The official docker-compose.middleware.yaml publishes host port 8194; the default docker-compose.yaml does not expose the sandbox. A wrong key gets 401, so authentication works and the weakness is the default value. The reporter found the sandbox isolated from database containers. A public PoC exists. No maintainer response or fix found.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dify","fixed":[],"affected":"<= 1.18.0, <= 2.0.0-beta.2 (reporter verified on 1.15.0)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-apps","ai-tooling","dify","docker","hardcoded-credentials","python","self-hosted"],"not_affected_if":["custom-sandbox-key","default-compose-only","managed-hosting","newer-version","sandbox-port-not-exposed"],"how_to_check":"- Search your deployment for the default: grep -rn 'dify-sandbox' docker/.env docker/middleware.env docker/volumes/sandbox/conf/config.yaml, and check that SANDBOX_API_KEY (sandbox) and CODE_EXECUTION_API_KEY (api/worker) are set to a strong unique value, not dify-sandbox.\n- Check whether the sandbox is reachable: docker compose -f docker-compose.middleware.yaml ps ssrf_proxy shows 0.0.0.0:8194->8194/tcp if exposed.\n- Test from another host: curl -s -X POST http://<host>:8194/v1/sandbox/run -H 'Content-Type: application/json' -H 'X-Api-Key: dify-sandbox' -d '{\"language\":\"python3\",\"code\":\"print(1)\",\"enable_network\":false}'. A 401 means the default key is not accepted. Run this only against your own systems.\n- Version: the reporter tested v1.15.0; NVD lists up to 1.18.0 / 2.0.0-beta.2.","fix":null,"status":"open","published_at":"2026-11-05T19:17:17+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","triaged_at":"2026-11-05T19:43:22+00:00","updated_at":"2026-11-05T19:44:13+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-11-05T19:43:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dify: hard-coded credentials in sandbox run handler config","impact":"medium","summary":"Dify, an open-source platform for building AI apps, ships hard-coded credentials in its sandbox run handler configuration file, api/configs/feature/__init__.py. A remote attacker may be able to use those credentials to reach functionality they should not access.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["dify","self-hosted","python","ai-apps"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker reaches sandbox handler using embedded credentials","analyst_note":"Confirm the fixed version and the exact credential behavior from the upstream Dify commit or advisory; the NVD entry alone does not state a fix.","how_to_check":"- Check the Dify version with the deployed image tag or `git describe --tags` in the source checkout; compare against `1.18.0` and `2.0.0-beta.2`.\n- Open `api/configs/feature/__init__.py` in your Dify deployment and look for hard-coded credential values in the Sandbox Run Handler section.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","newer-version"],"who_is_affected":"Teams that self-host Dify up to version 1.18.0 or 2.0.0-beta.2 and expose its API or sandbox run handler to a network. Hosted or managed Dify installs are the vendor's responsibility, and deployments on a private network with no exposure are at lower risk. The sources do not say which exact configuration enables the sandbox run handler by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4245,"output_tokens":620,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the exact credential behavior from the upstream Dify commit or advisory; the NVD entry alone does not state a fix.","search":"'-123135':22A,25A '-2026':21A,24A '/2.0.0-beta.2':150C '/v1/sandbox/run':90B '1.18.0':149C '115':68B '401':110B '8194':17A,97B 'affect':151C 'ai':28B,31B 'ai-app':27B 'ai-tool':30B 'allow':12A 'anyon':76B 'api':7A,55B 'api/configs/feature/__init__.py':67B,162C 'app':29B 'arbitrari':87B 'attack':178C 'authent':49B,112B 'code':13A,45B,175C 'code-execut':44B 'compon':165C 'contain':129B 'could':190C 'credenti':37B,176C 'cve':20A,23A 'databas':128B 'default':6A,59B,99B,119B 'difi':1A,10A,33B,42B,65B,146C 'dify':26A 'dify-sandbox':9A,64B 'docker':34B 'docker-compose.middleware.yaml':93B 'docker-compose.yaml':70B,100B 'docker/.env.example':69B 'execut':14A,46B 'exist':133B 'exploit':184C 'expos':103B 'file':161C 'fix':138B 'found':123B,139B,143C 'function':158C 'get':109B 'handler':168C 'hard':174C 'hard-cod':173C 'hardcod':36B 'hardcoded-credenti':35B 'host':41B,95B 'isol':126B 'key':8A,56B,84B,108B 'langgenius':145C 'langgenius/dify-sandbox':48B 'launch':181C 'made':187C 'maintain':135B 'manipul':170C 'offici':92B 'poc':132B 'port':16A,96B 'public':5A,62B,131B,188C 'publish':94B 'python':38B,88B 'reach':79B 'reachabl':19A 'remot':182C 'report':73B,122B 'request':50B 'respons':136B 'result':171C 'run':86B,167C 'sandbox':2A,11A,47B,66B,81B,105B,125B,166C 'self':40B 'self-host':39B 'ship':3A,58B 'show':74B 'string':63B 'tool':32B 'unknown':157C 'use':192C 'valu':120B 'volumes/sandbox/conf/config.yaml':71B 'vulner':141C,154C 'weak':116B 'whose':57B 'work':113B 'wrong':107B 'x':54B 'x-api-key':53B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Dify up to version 1.18.0 or 2.0.0-beta.2 and expose its API or sandbox run handler to a network. Hosted or managed Dify installs are the vendor's responsibility, and deployments on a private network with no exposure are at lower risk. The sources do not say which exact configuration enables the sandbox run handler by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["dify"],"ptokens":["dify"],"labels":["aiapps","aitooling","dify","docker","hardcodedcredentials","medium","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-123135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123135","severity":null,"published_at":"2026-11-05T19:17:17+00:00","modified_at":"2026-11-05T19:17:17+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","fetched_at":"2026-11-05T19:40:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123135:1822","url":"https://github.com/langgenius/dify/issues/44054","severity":null,"published_at":"2026-11-05T19:44:13+00:00","modified_at":"2026-11-05T19:44:13+00:00","first_seen_at":"2026-11-05T19:44:13+00:00","fetched_at":"2026-11-05T19:44:13+00:00","note":"No vendor advisory or fix found: upstream issue langgenius/dify#44054 (open, no maintainer reply; reporter's private GHSA unanswered) describes the real defect, a default sandbox key 'dify-sandbox'; NVD title 'hard-coded credentials in config' matches line 115 of api/configs/feature/__init__.py. Workaround from the issue thread (not vendor-confirmed): set strong SANDBOX_API_KEY and CODE_EXECUTION_API_KEY, pass --env-file middleware.env, restrict port 8194. Nothing marked verified (reporter sources only). NVD CVSS 6.5 vs reporter 7.5 (AV:A).","cites":["https://github.com/langgenius/dify/issues/44054","https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md"]}],"documents":[{"id":79515,"url":"https://github.com/langgenius/dify/issues/44054","title":"Dify code-execution sandbox uses shipped default API key dify-sandbox (CWE-798)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":79516,"url":"https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md","title":"Reporter advisory: Dify sandbox hardcoded default API key","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"exploit_sources":[{"type":"poc","url":"https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}