EUVD-2026-83707
GHSA-68r3-599r-wq4c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated and network-reachable, but success depends on the operator leaving hardcoded defaults in place (AC:H); impact is disclosure of a secret only (C:L, no confirmed I/A).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation causes information disclosure. It is possible to initiate the attack remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Hardcoded default secrets and credentials in aiyiyi121 SxDevOps 1.0/1.1 let unauthenticated remote attackers obtain sensitive information from instances that still run the shipped defaults - a Django SECRET_KEY of 'change-me' and the documented demo/admin password (for example Admin@123456) published in the project README. The issue is CWE-200 (exposure of sensitive information), rated CVSS 4.0 6.9 with confidentiality-only impact; no public exploit code has been identified at time of analysis, and any operator who set a strong SECRET_KEY, changed the admin/demo password, or disabled the demo accounts before exposing the service is not affected, so realistic risk is confined to negligently configured default installs of a niche self-hosted tool. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only when a SxDevOps 1.0/1.1 instance is deployed with the shipped defaults left unchanged - specifically a Django SECRET_KEY of 'change-me' and/or the documented demo/admin password (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS-number-but-low-real-risk issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix - the upstream commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9 (referenced as https://github.com/aiyiyi121/sxdevops/commit/2b4bf8585c3e731e7a8af30801ea46680bc783f9) or the corresponding fixed vendor release; patch data states a fix is available from the vendor, though the specific tagged version number is not given in the available data, so confirm the deployed revision includes this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SxDevOps 1.0 and 1.1 seed demo and administrator accounts with a hard-coded default password ('Admin@123456') that is al
Improper privilege management in SxDevOps 1.0/1.1 allows an authenticated user to escalate their own privileges by manip
Authenticated command injection in SxDevOps 1.0/1.1 lets a signed-in user with host-task/command-generation rights defea
Command injection in SxDevOps 1.0 and 1.1 allows a high-privileged, authenticated operator to escape intended command re
Command injection in SxDevOps 1.0 and 1.1 lets an authenticated user who can manage MCP STDIO server configurations run
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today