---
id: "CVE-2026-97693"
kind: "vulnerability"
aliases: ["CVE-2026-97693"]
title: "Yuxi: sandbox isolation flaw lets users reach other tenants' data"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Yuxi", "fixed": ["0.7.1"], "affected": ">= 0.6.0.beta1, < 0.7.1", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "docker", "minio", "neo4j", "postgresql", "self-hosted", "yuxi"]
not_affected_if: ["no-untrusted-sandbox-users", "sandbox-disabled", "trusted-users-only", "version-0.7.1-or-later"]
published_at: "2026-11-04T22:18:07+00:00"
first_seen_at: "2026-11-04T23:08:50+00:00"
updated_at: "2026-11-04T23:10:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97693", "first_seen_at": "2026-11-04T23:08:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T23:10:35+00:00"}]
exploit_sources: []
---

# Yuxi: sandbox isolation flaw lets users reach other tenants' data

Yuxi is an AI knowledge base and agent platform. A low-privileged user who can run commands in their own Docker sandbox can reach other tenants' sandbox files, secrets and APIs, and may gain command execution in the PostgreSQL container if default credentials remain.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:Yuxi affected >= 0.6.0.beta1, < 0.7.1 fixed 0.7.1

## How to check

- Check the deployed Yuxi version; affected is >= 0.6.0.beta1 and < 0.7.1.
- Check whether sandbox execution is enabled in your Docker Compose deployment and whether untrusted users can run commands in sandboxes.
- Check whether PostgreSQL, Neo4j or MinIO credentials in existing data volumes are still the documented/shipped defaults.
- Check whether the PostgreSQL account exposed to the app is a superuser (allows command execution in the PostgreSQL container).
- Check whether the provisioner API and database/MinIO/Neo4j/Redis ports are reachable from sandboxes or untrusted networks.

## Fix

Upgrade Yuxi to 0.7.1 or later, set a unique SANDBOX_PROVISIONER_TOKEN, and rotate any PostgreSQL, Neo4j or MinIO credentials still set to shipped defaults (the upgrade does not rotate credentials already stored in existing data volumes).

## Timeline

- 2026-11-04T23:08:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97693
- 2026-11-04T23:10:35+00:00 analyst — Read GHSA-qpm5-6332-9445: range >=0.6.0.beta1,<0.7.1, fixed 0.7.1; shipped defaults matter only where unchanged, fallback credentials removed in 0.7.1; the advisory does not say whether default Compose sets them. Workarounds per vendor: disable sandboxes or limit to trusted admins, isolate sandbox networks, block sandbox access to Postgres/Neo4j/MinIO/Redis/provisioner, restrict provisioner API, rotate credentials and agent secrets; password changes alone are not enough.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/xerrors/Yuxi/security/advisories/GHSA-qpm5-6332-9445
- [fix] Patch: github.com https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663

## From the sources

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.  From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_