Default Credentials Vulnerability in Dify by LangGenius

CVE-2025-56157

What is CVE-2025-56157?

The vulnerable Dify application allows unauthorized access due to default credentials hardcoded in the docker-compose.yaml file, exposing PostgreSQL username and password to potential attackers. This configuration oversight can result in serious security risks, as attackers may exploit these credentials to gain unauthorized access to sensitive data. Users of Dify versions up to 1.5.1 are particularly at risk and should take immediate corrective action to secure their installations.

References