CVE-2025-56157CRITICAL 9.8EPSS p52.2%

CVE-2025-56157CVE-2025-56157

Description

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.81% probability of exploitation · percentile 52.2% · 2026-06-19T12:03:05Z
Published2025-12-18
Last modified2026-01-29

Underlying weaknesses· 1

CWE-798

References

  1. http://dify.com
  2. https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd
  3. https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161
  4. https://github.com/langgenius/dify
  5. https://github.com/langgenius/dify/issues/15285
  6. https://github.com/langgenius/dify/pull/15286
  7. https://github.com/langgenius/dify/pull/15286.diff
  8. https://github.com/langgenius/dify/releases/tag/1.0.1

1

TypeTargetConfidenceTier
WeaknessUse of Hard-coded Credentialscwe-7980%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-52159
CVE
CVE-2025-63386
CVE
CVE-2025-63388
CVE
CVE-2025-67304
CVE
CVE-2025-41715
CVE
CVE-2025-55051
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.