{"id":"CVE-2025-56157","aliases":["EUVD-2025-204372","GHSA-f5cx-j2cw-pgfg"],"status":"published","title":"Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker...","description":"Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0086,"percentile":0.58942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2025-12-18T00:00:00Z","modified":"2026-10-28T02:30:20Z","products":[{"vendor":"langgenius","product":"dify"}],"references":[{"url":"https://github.com/langgenius/dify","tags":["Product","package"]},{"url":"https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd","tags":["exploit","Exploit","Mitigation","Third Party Advisory","web"]},{"url":"https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161","tags":["web"]},{"url":"https://github.com/langgenius/dify/releases/tag/1.0.1","tags":["web"]},{"url":"https://github.com/langgenius/dify/issues/15285","tags":["report"]},{"url":"https://github.com/langgenius/dify/pull/15286","tags":["fix"]},{"url":"https://github.com/langgenius/dify/pull/15286.diff","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56157","tags":["advisory"]},{"url":"http://dify.com"},{"url":"https://github.com/advisories/GHSA-f5cx-j2cw-pgfg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/56xxx/CVE-2025-56157.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-56157","description":"Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.","status":"published","published":"2025-12-18T00:00:00Z","modified":"2026-07-05T01:27:39.511Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:32:26.320248Z"}],"euvd":[{"id":"EUVD-2025-204372","description":"Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.","status":"published","published":"2025-12-18T00:00:00Z","modified":"2026-07-05T01:27:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:14.793418Z"}],"ghsa":[{"id":"GHSA-f5cx-j2cw-pgfg","title":"Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker...","description":"Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code.","status":"published","published":"2025-12-18T21:31:42Z","modified":"2026-01-29T18:31:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:05:58.473482Z"}],"nvd":[{"id":"CVE-2025-56157","description":"Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.","status":"published","published":"2025-12-18T19:16:26.687Z","modified":"2026-10-13T11:10:00.203Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:11:52.309391Z"}],"osv":[{"id":"CVE-2025-56157","description":"Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.","status":"published","published":"2025-12-18T00:00:00Z","modified":"2026-10-28T02:30:20.88387256Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:51.190588Z"}]}}