PT-2025-52280 · Dify+1 · Dify+1

Cristliu · Published 2025-12-18 · Updated 2026-01-29 · CVE-2025-56157

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dify versions through 1.5.1

Description The Dify application contains default credentials for PostgreSQL. The PostgreSQL username and password are specified in the docker-compose.yaml file included in the application's source code. The supplier indicates that the Docker configuration does not expose PostgreSQL (on TCP port 5432) by default in version 1.0.1 or later.

Recommendations Versions prior to 1.0.1 should have their docker-compose.yaml file reviewed and the default PostgreSQL username and password changed. Versions 1.0.1 and later should verify the Docker configuration does not expose PostgreSQL on TCP port 5432.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-56157

Affected Products

Dify

Postgresql

References · 17

• 🔥 https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56157 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56157 · Vendor Advisory
• https://github.com/langgenius/dify/pull/15286 · Note
• https://github.com/langgenius/dify/pull/15286.diff · Note
• https://github.com/langgenius/dify/issues/15285 · Note
• https://github.com/langgenius/dify/releases/tag/1.0.1 · Note
• https://github.com/langgenius/dify · Note
• http://dify.com · Note
• https://twitter.com/HackingTeam777/status/2003195982629265500 · Twitter Post
• https://twitter.com/CVEnew/status/2002487742073311601 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001777400904880559 · Twitter Post
• https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161 · Note
• https://t.me/proxy_bar/2975 · Telegram Post
• https://t.me/cveNotify/150170 · Telegram Post