# CVE-2026-123135: langgenius dify hard-coded credentials in sandbox

Source: https://junglewise.ai/threats/cve-2026-123135-a-vulnerability-was-found-in-langgenius-dify-up-to-1-18-0-2-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-123135 · Severity: medium · CVSS 6.3 · Published 2026-11-05

Dify is a platform for building AI workflows and LLM applications. The code-execution sandbox component uses a default, trivially guessable API key ("dify-sandbox") for authentication, allowing remote attackers to bypass authentication and execute arbitrary code on the sandbox with no credentials required.

Technologies: [Langgenius Dify](https://junglewise.ai/threats/technologies/dify). Vendors: [Langgenius](https://junglewise.ai/threats/vendors/langgenius).

## Quick answers

**Is CVE-2026-123135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123135 being exploited in the wild.

**How severe is CVE-2026-123135?** Medium severity, with a CVSS score of 6.3, published 5 November 2026.

**Which products and versions are affected?** Langgenius Dify up to 1.18.0 and 2.0.0-beta.2.

**Is there a fix for CVE-2026-123135?** No fixed version is recorded yet. Change the CODE_EXECUTION_API_KEY and SANDBOX_API_KEY environment variables from the default value "dify-sandbox" to a strong, unique secret in docker/.env or your deployment configuration. Do not use the .env.example file directly for production without modifying these credentials.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123135 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123135?** Check whether you run Langgenius Dify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Change the CODE_EXECUTION_API_KEY and SANDBOX_API_KEY environment variables from the default value "dify-sandbox" to a strong, unique secret in docker/.env or your deployment configuration. Do not use the .env.example file directly for production without modifying these credentials.</anigation>
</invoke>

## Technical details

The vulnerability stems from hard-coded credentials (CWE-798) in the Sandbox Run Handler component (api/configs/feature/__init__.py), which authenticates API requests via the X-Api-Key header against a default public key "dify-sandbox". An attacker can remotely send requests with this known key to achieve unauthorized code execution. The default key is shipped in deployment examples and remains active unless explicitly changed by operators.

## Affected products

- langgenius dify up to 1.18.0 and 2.0.0-beta.2

## Timeline

- 2026-07-02: disclosed: Privately reported via GitHub Security Advisory GHSA-hqjv-c67p-8hwv
- 2026-11-05: advisory
- 2026-10-16: other: Fix PR #44192 opened

## References

- [https://github.com/langgenius/dify/](https://github.com/langgenius/dify/)
- [https://github.com/langgenius/dify/issues/44054](https://github.com/langgenius/dify/issues/44054)

## Related threats

- [Dify authorization bypass in MCP server endpoint](https://junglewise.ai/threats/cve-2026-105761-dify-is-an-open-source-llm-app-development-platform-prior-to-1)
- [langgenius dify DOM-based XSS in redirect URL handler](https://junglewise.ai/threats/cve-2026-85022-langgenius-dify-dom-based-xss-in-redirect-url-handler)
- [langgenius Dify DOM-based XSS in splash.tsx redirect](https://junglewise.ai/threats/cve-2026-85021-langgenius-dify-dom-based-xss-in-splash-tsx-redirect)
- [LangGenius Dify server-side template injection in Jinja2 handler](https://junglewise.ai/threats/cve-2026-18632-langgenius-dify-server-side-template-injection-in-jinja2-handler)
- [LangGenius Dify open redirect in AppInitializer OAuth flow](https://junglewise.ai/threats/cve-2026-18266-langgenius-dify-open-redirect-in-appinitializer-oauth-flow)