Executive brief
SxDevOps is an open-source operations automation and workflow platform. The software contained hard-coded default credentials in its superuser initialization function, allowing remote attackers to gain administrative access without authentication. An attacker could use these fixed credentials to take over the entire system and access sensitive operational data and configurations.
Technical details
The vulnerability exists in the ensure_default_superuser function in rbac/services.py, which used hard-coded credentials (Admin@123456) for the default superuser account during initialization. An unauthenticated remote attacker can exploit this over the network to obtain administrative privileges. A patch has been released that replaces hard-coded credentials with environment variable-based or randomly-generated passwords.
Affected products
- aiyiyi121 SxDevOps 1.0, 1.1
Timeline
- 2026-09-20: disclosed
- 2026-09-06: patched: Patch commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9 released before public disclosure