The SxDevOps application contains hard-coded credentials that enable unauthenticated remote access to administrative functions.

This vulnerability involves the use of hard-coded credentials within the ensure_default_superuser function of the rbac/services.py file. Because the authentication mechanism relies on these static credentials, an unauthenticated remote attacker can gain unauthorized access to the application.

The presence of hard-coded credentials poses a significant security risk, as it allows attackers to bypass standard authentication controls completely. With a CVSS score of 7.3, this high-severity vulnerability could lead to full unauthorized access to the DevOps environment, potentially resulting in data exfiltration, service disruption, or the compromise of integrated development pipelines.

Immediate Action: Update the SxDevOps installation to a version that incorporates the fix provided in commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

Proactive Monitoring: Review system and authentication logs for anomalous login attempts or unauthorized usage of administrative accounts.

Compensating Controls: If an immediate update is not feasible, restrict network access to the SxDevOps interface using firewall rules or a VPN to limit exposure to untrusted networks.

Public Exploit Available: No

Given the high severity of this vulnerability and the ease with which an attacker can leverage hard-coded credentials to gain unauthorized access, immediate remediation is required. Administrators should prioritize patching the affected SxDevOps instances to the vendor-provided fixed version to eliminate the risk of remote compromise.