CVE-2026-93970
HighCVSS 7.3Summary
A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1 in the file backend/sxdevops/settings.py of the Settings Handler component. The manipulation results in hard-coded credentials. The attack may be performed remotely. The patch is identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
Risk Assessment
An attacker could remotely exploit hard-coded credentials to gain unauthorized access to the system.
Recommendation
Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 to resolve this issue.
Other vulnerabilities in SxDevOps
See all- CVE-2026-93971Medium
A weakness has been identified in SxDevOps versions 1.0 and 1.1 in an unknown function of the file backend/sxdevops/settings.py, leading to information disclosure. The attack can be initiated remotely. A patch named 2b4bf8585c3e731e7a8af30801ea46680bc783f9 is available.
- CVE-2026-93969High
A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1 in the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible remotely. The patch identifier is 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93968Low
A vulnerability was found in SxDevOps versions 1.0/1.1 in the update function of backend/rbac/serializers.py, within the UserSerializer component. Input manipulation can lead to improper privilege management, and the attack can be executed remotely. The vendor was notified and quickly released a fixed version (patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9).
- CVE-2026-93967Medium
A vulnerability was found in SxDevOps versions 1.0 and 1.1 in the generate_host_task function of the file backend/aiops/services.py (Command Handler component). Manipulation of the command argument results in command injection, and the attack can be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93966Medium
A vulnerability has been found in SxDevOps versions 1.0 and 1.1 in the paramiko.SSHClient.exec_command function of the file backend/ops/host_tasks.py (TASK_RUN_COMMAND component). Manipulation of the command argument leads to command injection, and the attack may be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93965Medium
A flaw has been found in SxDevOps versions 1.0 and 1.1 in the subprocess.Popen function of the file backend/aiops/services.py (MCP STDIO Server Management component). Manipulation of the endpoint_or_command argument causes command injection, and the attack may be initiated remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
Original NVD description (English source)
A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. The attack may be performed from remote. The patch is identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.