---
id: "CVE-2026-123135"
kind: "vulnerability"
aliases: ["CVE-2026-123135"]
title: "Dify: sandbox ships with public default API key \"dify-sandbox\", allowing code execution if port 8194 is reachable"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "dify", "fixed": [], "affected": "<= 1.18.0, <= 2.0.0-beta.2 (reporter verified on 1.15.0)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-apps", "ai-tooling", "dify", "docker", "hardcoded-credentials", "python", "self-hosted"]
not_affected_if: ["custom-sandbox-key", "default-compose-only", "managed-hosting", "newer-version", "sandbox-port-not-exposed"]
published_at: "2026-11-05T19:17:17+00:00"
first_seen_at: "2026-11-05T19:40:35+00:00"
updated_at: "2026-11-05T19:44:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123135", "first_seen_at": "2026-11-05T19:40:35+00:00"}, {"source": "analyst", "url": "https://github.com/langgenius/dify/issues/44054", "first_seen_at": "2026-11-05T19:44:13+00:00", "cites": ["https://github.com/langgenius/dify/issues/44054", "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md"]}]
exploit_sources: [{"type": "poc", "url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md"}]
---

# Dify: sandbox ships with public default API key "dify-sandbox", allowing code execution if port 8194 is reachable

Dify's code-execution sandbox (langgenius/dify-sandbox) authenticates requests with an X-Api-Key whose shipped default is the public string "dify-sandbox" (api/configs/feature/__init__.py:115, docker/.env.example, docker-compose.yaml, volumes/sandbox/conf/config.yaml). The reporter shows that anyone who can reach the sandbox with that key can run arbitrary Python on /v1/sandbox/run. The official docker-compose.middleware.yaml publishes host port 8194; the default docker-compose.yaml does not expose the sandbox. A wrong key gets 401, so authentication works and the weakness is the default value. The reporter found the sandbox isolated from database containers. A public PoC exists. No maintainer response or fix found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dify affected <= 1.18.0, <= 2.0.0-beta.2 (reporter verified on 1.15.0) fixed no fixed version listed

## How to check

- Search your deployment for the default: grep -rn 'dify-sandbox' docker/.env docker/middleware.env docker/volumes/sandbox/conf/config.yaml, and check that SANDBOX_API_KEY (sandbox) and CODE_EXECUTION_API_KEY (api/worker) are set to a strong unique value, not dify-sandbox.
- Check whether the sandbox is reachable: docker compose -f docker-compose.middleware.yaml ps ssrf_proxy shows 0.0.0.0:8194->8194/tcp if exposed.
- Test from another host: curl -s -X POST http://<host>:8194/v1/sandbox/run -H 'Content-Type: application/json' -H 'X-Api-Key: dify-sandbox' -d '{"language":"python3","code":"print(1)","enable_network":false}'. A 401 means the default key is not accepted. Run this only against your own systems.
- Version: the reporter tested v1.15.0; NVD lists up to 1.18.0 / 2.0.0-beta.2.

## Timeline

- 2026-11-05T19:40:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123135
- 2026-11-05T19:44:13+00:00 analyst https://github.com/langgenius/dify/issues/44054 — No vendor advisory or fix found: upstream issue langgenius/dify#44054 (open, no maintainer reply; reporter's private GHSA unanswered) describes the real defect, a default sandbox key 'dify-sandbox'; NVD title 'hard-coded credentials in config' matches line 115 of api/configs/feature/__init__.py. Workaround from the issue thread (not vendor-confirmed): set strong SANDBOX_API_KEY and CODE_EXECUTION_API_KEY, pass --env-file middleware.env, restrict port 8194. Nothing marked verified (reporter sources only). NVD CVSS 6.5 vs reporter 7.5 (AV:A).

## Documents

- [describes] Dify code-execution sandbox uses shipped default API key dify-sandbox (CWE-798) https://github.com/langgenius/dify/issues/44054
- [poc] Reporter advisory: Dify sandbox hardcoded default API key https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dify/dify-sandbox-hardcoded-default-api-key.md

## From the sources

A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_