CVE-2025-56157

Katalog CVE

CVSS 9.8 · Critical EPSS 0,86%

Kerentanan Use of Hard-coded Credentials pada langgenius dify. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.

Rincian

Terbit di NVD

18 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd exploit · mitigasi · advisory pihak ketiga
• https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161
• https://github.com/langgenius/dify product
• https://github.com/langgenius/dify/issues/15285
• https://github.com/langgenius/dify/pull/15286
• https://github.com/langgenius/dify/pull/15286.diff
• https://github.com/langgenius/dify/releases/tag/1.0.1