CVE-2026-123135

Dify’s shipped sandbox key permits unauthorized execution when its port is exposed

langgenius · Dify self-hosted sandbox

First documented disclosure · Review checkpoint

Summary

A public default credential can authorize Python or JavaScript execution inside the sandbox.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The original report demonstrates controlled execution with the default key and rejection of a wrong key. Malicious use is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The examples and configuration reuse a predictable key. The official middleware Compose deployment publishes the sandbox through port 8194.

Conditions required

The default key remains unchanged and an attacker can reach the sandbox. The ordinary Compose deployment does not expose that port.

Potential impact

Unauthorized code runs inside the sandbox. The researcher’s attempt to reach the database network failed; host escape was not demonstrated.

Affected versions and configurations

VulDB lists releases through 1.18.0 and 2.0.0-beta.2. The researcher tested 1.15.0.

Fix and mitigation status

No fixed release verified. Proposed PR 44192 remained unmerged at review.

Practical next steps

Generate a unique sandbox credential, synchronize it across services and remove public access to the sandbox port.

Operating lesson

A working authentication check is ineffective when every installation shares a published credential.

Evidence and limits

The October 14 public disclosure followed private reporting in July. A proposed key-generation and network change is not a shipped fix. The CNA’s medium CVSS 4.0 score is distinct from the researcher’s higher assessment.

Sources