---
id: CVE-2025-56157
title: Default credentials in Dify thru 1.5.1
summary: >-
  Default credentials in Dify thru 1.5.1. PostgreSQL username and password
  specified in the docker-compose.yaml file included in its source code. NOTE:
  the Supplier reports that the Docker configuration does not make PostgreSQL
  (on TCP por…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-798
vendor: langgenius
product: dify
affected:
  - dify <= 1.5.1
published: '2025-12-18'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-56157'
references:
  - url: 'https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd'
    label: cve@mitre.org
  - url: 'https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161'
    label: cve@mitre.org
  - url: 'https://github.com/langgenius/dify'
    label: cve@mitre.org
  - url: 'https://github.com/langgenius/dify/issues/15285'
    label: cve@mitre.org
  - url: 'https://github.com/langgenius/dify/pull/15286'
    label: cve@mitre.org
  - url: 'https://github.com/langgenius/dify/pull/15286.diff'
    label: cve@mitre.org
  - url: 'https://github.com/langgenius/dify/releases/tag/1.0.1'
    label: cve@mitre.org
  - url: 'https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0086
epssPercentile: 0.57367
ingestedAt: '2026-10-13T11:23:51.135Z'
---

## Overview

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.

## Affected

- `dify <= 1.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.