What is the CVSS score of CVE-2025-56157?

CVE-2025-56157 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Dify are affected by CVE-2025-56157?

Dify versions through 1.5.1 ship with hard-coded PostgreSQL credentials in docker-compose.yaml, potentially exposing the backend database to complete read/write access from any system with network…

Is there a public PoC exploit available for CVE-2025-56157?

Yes, a public proof-of-concept exploit is available for CVE-2025-56157. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2025-56157?

24 hours: Verify your deployment is running Dify 1.0.1 or later and confirm through your network topology that the PostgreSQL port is not accessible from untrusted networks; review docker-compose.yaml to document your current credential configuration. 7 days: Rotate PostgreSQL credentials to strong, non-default values; update docker-compose.yaml with custom credentials and redeploy; if running versions prior to 1.0.1, upgrade to version 1.5.1 immediately. 30 days: Implement network firewall rules restricting PostgreSQL port access to the application tier only; deploy database connection logging and alerting for unauthorized access attempts; conduct a comprehensive audit of database transaction logs for any unauthorized access since deployment.

Dify CVE-2025-56157

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2025-12-18 cve@mitre.org

Authentication Bypass Docker PostgreSQL Dify

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Static credentials give full DB compromise (C/I/A:H) with no auth, but AC:H because default configs (1.0.1+) do not expose port 5432, requiring non-default network exposure.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:29 vuln.today

CVE Published

Dec 18, 2025 - 19:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.

AnalysisAI

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 allow anyone who can reach the database port to authenticate with full read/write access to the backend datastore. Publicly available exploit code exists, though EPSS remains low (0.81%) and the vendor states the database port is not network-exposed by default in 1.0.1 and later, limiting realistic reach. There is no public exploit identified as actively used in the wild (not in CISA KEV).

Technical ContextAI

Dify is an open-source LLM application development platform (langgenius/dify, Node.js/Python stack) that ships a docker-compose deployment bundling a PostgreSQL 15 container. The root cause is CWE-798 (Use of Hard-Coded Credentials): the docker-compose.yaml embeds a static, well-known PostgreSQL username and password in its source repository, so every default deployment that leaves these values unchanged shares identical database credentials. PostgreSQL listens on TCP 5432; the vulnerability is only remotely reachable if that port is published to an accessible network, which the supplier reports is no longer the default mapping in releases 1.0.1 and later.

RemediationAI

Upgrade to Dify 1.0.1 or later (https://github.com/langgenius/dify/releases/tag/1.0.1), where the Docker configuration no longer exposes PostgreSQL by default; the corresponding change is in PR https://github.com/langgenius/dify/pull/15286 . Because the underlying default credentials still ship in docker-compose.yaml, also rotate the PostgreSQL username and password to unique strong values in your .env/compose configuration rather than relying on the shipped defaults. As compensating controls, ensure port 5432 is not published to any untrusted network (remove the ports mapping so the DB is only reachable on the internal Docker network - side effect: you lose direct external DB tooling access), and restrict host firewall rules to block inbound 5432 from outside the Docker host. These controls close the network path even where the default credentials remain unchanged.