CVE-2025-56157

Published: Dec 18, 2025Modified: Jul 5, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.

Affected (1)

Products: Langgenius: Dify

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Langgenius Dify	Up to 1.5.1

Related CWEs

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (8)

https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161

Source: cve@mitre.org

https://github.com/langgenius/dify

Source: cve@mitre.org

Product

https://github.com/langgenius/dify/issues/15285

Source: cve@mitre.org

https://github.com/langgenius/dify/pull/15286

Source: cve@mitre.org

https://github.com/langgenius/dify/pull/15286.diff

Source: cve@mitre.org

https://github.com/langgenius/dify/releases/tag/1.0.1

Source: cve@mitre.org

https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationThird Party Advisory

Timeline

No history available yet.