{"id":"CVE-2026-97693","kind":"vulnerability","aliases":["CVE-2026-97693"],"related":[],"title":"Yuxi: sandbox isolation flaw lets users reach other tenants' data","description":"Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.  From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them.","summary":"Yuxi is an AI knowledge base and agent platform. A low-privileged user who can run commands in their own Docker sandbox can reach other tenants' sandbox files, secrets and APIs, and may gain command execution in the PostgreSQL container if default credentials remain.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Yuxi","fixed":["0.7.1"],"affected":">= 0.6.0.beta1, < 0.7.1","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","docker","minio","neo4j","postgresql","self-hosted","yuxi"],"not_affected_if":["no-untrusted-sandbox-users","sandbox-disabled","trusted-users-only","version-0.7.1-or-later"],"how_to_check":"- Check the deployed Yuxi version; affected is >= 0.6.0.beta1 and < 0.7.1.\n- Check whether sandbox execution is enabled in your Docker Compose deployment and whether untrusted users can run commands in sandboxes.\n- Check whether PostgreSQL, Neo4j or MinIO credentials in existing data volumes are still the documented/shipped defaults.\n- Check whether the PostgreSQL account exposed to the app is a superuser (allows command execution in the PostgreSQL container).\n- Check whether the provisioner API and database/MinIO/Neo4j/Redis ports are reachable from sandboxes or untrusted networks.","fix":"Upgrade Yuxi to 0.7.1 or later, set a unique SANDBOX_PROVISIONER_TOKEN, and rotate any PostgreSQL, Neo4j or MinIO credentials still set to shipped defaults (the upgrade does not rotate credentials already stored in existing data volumes).","status":"open","published_at":"2026-11-04T22:18:07+00:00","first_seen_at":"2026-11-04T23:08:50+00:00","triaged_at":"2026-11-04T23:09:39+00:00","updated_at":"2026-11-04T23:10:35+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-04T23:09:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Yuxi to `0.7.1`.\n- Rotate persisted PostgreSQL, Neo4j or MinIO credentials that were set to documented or shipped defaults; upgrading the Compose files does not rotate them.","reach":"network","title":"Yuxi: sandbox isolation flaw lets users reach other tenants' data","impact":"high","summary":"Yuxi is an AI knowledge base and agent platform. A low-privileged user who can run commands in their own Docker sandbox can reach other tenants' sandbox files, secrets and APIs, and may gain command execution in the PostgreSQL container if default credentials remain.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["yuxi","docker","self-hosted","postgresql","minio","neo4j"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"cross-tenant data read or modified; command execution in PostgreSQL container","analyst_note":"Confirm the affected version range against the GitHub advisory and patch linked in the sources, and whether the default-credential path applies to the default Compose setup.","how_to_check":"- Check the Yuxi version in the deployment; affected range is from `0.6.0.beta1` until `0.7.1`.\n- Check whether persisted PostgreSQL, Neo4j or MinIO credentials are still the shipped defaults.\n- Check whether the PostgreSQL account used by the app is a superuser.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.7.1-or-later","no-untrusted-sandbox-users"],"who_is_affected":"Deployments of Yuxi from 0.6.0.beta1 up to 0.7.1 that use its Docker sandboxes for multiple tenants or users. Exposure is worse where shipped default service credentials were never changed or the PostgreSQL account is a superuser. Single-user deployments without untrusted users who can run sandbox commands are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000821,"input_tokens":4561,"output_tokens":729,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected version range against the GitHub advisory and patch linked in the sources, and whether the default-credential path applies to the default Compose setup.","search":"'-2026':12A,15A '-97693':13A,16A '0.6.0':91C '0.7.1':94C,224C 'access':129C 'account':180C 'activ':137C 'administr':151C 'agent':36B,87C 'ai':19B,32B 'ai-tool':18B 'also':158C 'api':60B,128C 'applic':107C 'attack':171C 'authent':113C 'automat':252C 'base':34B,80C,83C 'beta1':92C 'capabl':102C 'caus':205C 'command':46B,64B,118C,135C,185C 'compos':248C 'contain':69B,190C,214C 'creat':141C 'credenti':72B,155C,167C,235C 'cross':198C 'cross-ten':197C 'cve':11A,14A 'data':10A,200C 'databas':152C 'default':71B,165C,244C 'delet':143C,211C 'denial':206C 'deploy':226C 'develop':88C 'disclos':194C 'docker':21B,50B,103C 'document':241C 'enumer':140C 'escap':215C 'execut':65B,101C,117C,134C,186C 'execution-cap':100C 'exist':225C 'expos':178C 'file':57B,131C,249C 'fix':222C 'flaw':4A 'gain':63B 'graph':86C 'host':27B 'insuffici':97C 'intellig':81C 'intern':161C 'isol':3A,98C 'kernel':217C 'know':150C 'knowledg':33B,82C,85C 'larg':78C 'large-model-bas':77C 'let':5A 'low':40B,111C 'low-privileg':39B,110C 'may':62B 'minio':22B,154C,234C 'model':79C 'modifi':196C 'must':227C 'neo4j':23B,232C 'obtain':184C 'path':192C 'persist':230C 'platform':37B,89C 'postgresql':24B,68B,179C,189C,231C 'previous':238C 'privileg':41B,112C 'provision':148C 'reach':7A,53B,124C,159C 'remain':73B,168C 'rotat':229C,253C 'run':45B 'sandbox':2A,51B,56B,104C,122C,127C,138C,144C,156C,202C,210C 'secret':58B,133C 'self':26B 'self-host':25B 'separ':228C 'servic':108C,162C,166C,208C 'set':239C 'share':160C 'ship':164C,243C 'state':203C 'superus':183C 'tenant':9A,55B,126C,199C 'tool':20B 'trust':106C 'unauthent':147C 'unchang':169C 'upgrad':246C 'use':173C 'user':6A,42B,114C 'vulner':218C,220C 'without':149C,212C 'yuxi':1A,17A,28B,29B,74C","nicknames":[],"mitigations":[],"who_affected":"Yuxi Docker Compose deployments from 0.6.0.beta1 up to but not including 0.7.1 that enable execution-capable sandboxes. Any low-privileged user who can run commands in their own sandbox can reach other tenants' sandboxes, files and secrets, the unauthenticated provisioner API, and internal services such as PostgreSQL, Neo4j and MinIO; unchanged default credentials and a superuser PostgreSQL account make it worse. Deployments with sandboxes fully disabled and internal services isolated, or with only trusted administrators as users, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T23:10:35Z","by":"analyst","doc":"https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663","run_id":1726},"products":{"at":"2026-11-04T23:10:35Z","by":"analyst","doc":"https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663","run_id":1726},"how_to_check":{"at":"2026-11-04T23:10:35Z","by":"analyst","doc":"https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663","run_id":1726},"who_affected":{"at":"2026-11-04T23:10:35Z","by":"analyst","doc":"https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663","run_id":1726}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["yuxi"],"ptokens":["yuxi"],"labels":["aitooling","critical","docker","minio","neo4j","postgresql","selfhosted","yuxi"],"campaign_type":null,"first_public_at":"2026-08-24T12:29:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97693","severity":null,"published_at":"2026-11-04T22:18:07+00:00","modified_at":"2026-11-04T22:18:07+00:00","first_seen_at":"2026-11-04T23:08:50+00:00","fetched_at":"2026-11-04T23:08:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97693:1726","url":null,"severity":null,"published_at":"2026-11-04T23:10:35+00:00","modified_at":"2026-11-04T23:10:35+00:00","first_seen_at":"2026-11-04T23:10:35+00:00","fetched_at":"2026-11-04T23:10:35+00:00","note":"Read GHSA-qpm5-6332-9445: range >=0.6.0.beta1,<0.7.1, fixed 0.7.1; shipped defaults matter only where unchanged, fallback credentials removed in 0.7.1; the advisory does not say whether default Compose sets them. Workarounds per vendor: disable sandboxes or limit to trusted admins, isolate sandbox networks, block sandbox access to Postgres/Neo4j/MinIO/Redis/provisioner, restrict provisioner API, rotate credentials and agent secrets; password changes alone are not enough."}],"documents":[{"id":71186,"url":"https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71187,"url":"https://github.com/xerrors/Yuxi/security/advisories/GHSA-qpm5-6332-9445","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-24T12:29:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}