# CVE-2026-93970: aiyiyi121 SxDevOps hard-coded credentials in settings

Source: https://junglewise.ai/threats/cve-2026-93970-a-security-flaw-has-been-discovered-in-aiyiyi121-sxdevops-1-0-1-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-20. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93970 · Severity: high · CVSS 7.3 · Published 2026-09-20

SxDevOps is an open-source DevOps automation platform that manages infrastructure and operations workflows. A hard-coded credential vulnerability in the Settings Handler component could allow remote attackers to gain unauthorized access to the platform without authentication. An attacker could use these fixed credentials to execute arbitrary operations, access sensitive data, or compromise the entire DevOps infrastructure managed by the platform.

Technologies: [Aiyiyi121 SxDevOps](https://junglewise.ai/threats/technologies/sxdevops). Vendors: [Aiyiyi121](https://junglewise.ai/threats/vendors/aiyiyi121).

## Quick answers

**Is CVE-2026-93970 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93970 being exploited in the wild.

**How severe is CVE-2026-93970?** High severity, with a CVSS score of 7.3, published 20 September 2026.

**Which products and versions are affected?** Aiyiyi121 SxDevOps 1.0, 1.1.

**Is there a fix for CVE-2026-93970?** A patch was published on 2026-09-06: Patch commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93970 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-93970?** Check whether you run Aiyiyi121 SxDevOps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in backend/sxdevops/settings.py where hard-coded credentials are embedded in the component. The attack is remotely exploitable with no authentication required. An attacker can leverage these credentials to bypass authentication mechanisms and gain unauthorized access to the DevOps platform. A patch was released on 2026-09-06 (commit 2b4bf85) that replaces hard-coded passwords with environment variable-driven configuration.

## Affected products

- aiyiyi121 SxDevOps 1.0, 1.1

## Timeline

- 2026-09-20: disclosed: CVE-2026-93970 published on NVD
- 2026-09-06: patched: Patch commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9 released

## References

- [https://github.com/aiyiyi121/sxdevops/](https://github.com/aiyiyi121/sxdevops/)
- [https://github.com/aiyiyi121/sxdevops/commit/2b4bf8585c3e731e7a8af30801ea46680bc783f9](https://github.com/aiyiyi121/sxdevops/commit/2b4bf8585c3e731e7a8af30801ea46680bc783f9)

## Related threats

- [aiyiyi121 SxDevOps information disclosure in settings.py](https://junglewise.ai/threats/cve-2026-93971-a-weakness-has-been-identified-in-aiyiyi121-sxdevops-1-0-1-1)
- [SxDevOps hard-coded credentials in default superuser initialization](https://junglewise.ai/threats/cve-2026-93969-a-vulnerability-was-identified-in-aiyiyi121-sxdevops-1-0-1-1-this)
- [aiyiyi121 SxDevOps command injection in generate_host_task](https://junglewise.ai/threats/cve-2026-93967-a-vulnerability-was-found-in-aiyiyi121-sxdevops-1-0-1-1-affected)
- [aiyiyi121 SxDevOps command injection in task execution](https://junglewise.ai/threats/cve-2026-93966-a-vulnerability-has-been-found-in-aiyiyi121-sxdevops-1-0-1-1)
- [aiyiyi121 SxDevOps command injection in subprocess handling](https://junglewise.ai/threats/cve-2026-93965-a-flaw-has-been-found-in-aiyiyi121-sxdevops-1-0-1-1-affected-is)