CVE-2025-56157: Critical severity docker-compose/dify vulnerability
Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Dify versions up to and including 1.5.1, update the PostgreSQL username and password used via docker-compose.yaml (these credentials are specified in the source code) to unique, non-default values.
Dify default PostgreSQL credentials (PostgreSQL username/password used by docker-compose.yaml) = change from defaults to unique credentials - Compensating control
Ensure the PostgreSQL service is not exposed publicly on TCP port 5432 (the supplier notes docker does not expose it by default in Dify 1.0.1+). Verify Docker/networking configuration prevents external access to port 5432.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56157?
CVE-2025-56157 has a medium severity due to the presence of default credentials that can be exploited.
How do I fix CVE-2025-56157?
To fix CVE-2025-56157, change the default PostgreSQL username and password specified in the docker-compose.yaml file.
Which versions of Dify are affected by CVE-2025-56157?
Dify versions up to and including 1.5.1 are affected by CVE-2025-56157.
What type of vulnerability is CVE-2025-56157?
CVE-2025-56157 is a security vulnerability related to default credentials in a configuration file.
Can CVE-2025-56157 lead to unauthorized access?
Yes, CVE-2025-56157 can lead to unauthorized access due to the use of default credentials.