CVE Alert: CVE-2026-93969 – aiyiyi121

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be carried out remotely. The identifier of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Treat this as a high operational priority for any internet-facing deployment; KEV, SSVC exploitation state, EPSS and PoC availability are not provided, so active exploitation cannot be confirmed.

Unauthorised access could expose operational data, alter development workflows, disrupt services or create privileged accounts for persistence. The absence of user interaction and the potential for unauthenticated remote access materially increases the likelihood of opportunistic exploitation, even though the assessed impact is limited to the affected service boundary.

### Most likely attack path

An attacker would identify an exposed SxDevOps endpoint and send crafted requests remotely, without prior privileges or victim interaction. Low attack complexity makes scanning and automated credential abuse plausible; scope is unchanged, but a compromised service account could still provide a stepping stone to repositories, build agents, secrets or connected infrastructure.

### Who is most exposed

Internet-facing self-hosted instances, default installations, development portals and deployments integrated with source control or CI/CD systems are the principal risks. Internal instances remain exposed where network segmentation is weak or remote-access gateways allow broad reachability.

Review authentication logs for unexpected superuser creation or use.

Hunt for successful logins from new geographies, hosts or automation clients.

Alert on privilege changes, unusual API access and bulk repository or pipeline activity.

Check outbound connections and process activity from the application host.

### Mitigation and prioritisation

Apply the vendor’s fixed release or patch promptly; prioritise internet-facing systems first.

Rotate all built-in, shared and service credentials, and invalidate active sessions and tokens.

Restrict management interfaces with VPN, allow-listing and network segmentation.

Disable default-account creation where supported and enforce unique secrets through deployment automation.

Validate the change in staging, then confirm remediation by rescanning and reviewing authentication telemetry.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.