Description

A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-11-05T19:17:17.670Z",
  "pubdate": "2026-11-05T19:17:17.670Z",
  "executiveSummary": "A critical security vulnerability identified as hard-coded credentials has been discovered in langgenius dify versions up to 1.18.0 and 2.0.0-beta.2.\nThe vulnerability resides within the Sandbox Run Handler, specifically in the file api/configs/feature/__init__.py.\nThis flaw allows unauthorized remote actors to gain access to sensitive internal mechanisms by leveraging embedded, static authentication tokens or credentials.\nThe exposure of such credentials undermines the security posture of the application's sandbox environment, potentially leading to unauthorized execution or information disclosure.\nGiven that the exploit is currently public, the risk of exploitation is significantly elevated. Remote attackers can leverage these static credentials to bypass authentication protocols associated with the Sandbox Run Handler, facilitating unauthorized interactions with the backend sandbox infrastructure.\nImmediate remediation is required to revoke the compromised credentials and implement secure secrets management practices.",
  "technicalDetails": "The vulnerability originates from the inclusion of hard-coded credentials within the api/configs/feature/__init__.py source file of the langgenius dify Sandbox Run Handler component.\nIn software engineering, hard-coding sensitive information—such as API keys, service tokens, or administrative credentials—within the codebase is a critical security flaw. These values are often committed to version control systems and remain immutable unless the source code is modified.\nThe Sandbox Run Handler is responsible for managing isolated execution environments for code tasks. By embedding static authentication data directly into the configuration module, the application fails to utilize dynamic, environment-based, or vault-backed secret management. This allows any entity with access to the source code or an attacker who can infer the static credentials to authenticate against the sandbox service.\nExploitation is feasible via remote network interaction. Because the credentials are static and likely shared across all installations using the affected versions, an attacker does not require local access or complex brute-force mechanisms to gain unauthorized control over the sandbox interface.\nThe attack flow proceeds as follows: First, an attacker identifies the presence of the hard-coded credentials through static analysis of the exposed or public source code. Second, the attacker crafts a request to the Sandbox Run Handler, injecting the identified credentials into the appropriate authentication headers or parameters. Finally, the server validates the request using the hard-coded value, granting the attacker access to the sandbox environment with the permissions associated with those credentials.\nThe post-exploitation impact includes the potential for unauthorized code execution within the sandbox, which may lead to privilege escalation or lateral movement if the sandbox configuration does not provide adequate containerization or isolation. Furthermore, the exposure of these credentials compromises the integrity of the sandbox communication channel, allowing for command injection or the manipulation of sandbox-related task parameters.\nAffected versions include all iterations up to 1.18.0 and 2.0.0-beta.2. The vulnerability persists until the hard-coded strings are removed and replaced with a secure mechanism, such as environment variables or a dedicated Secrets Management Service."
}