Critical · published December 19, 2025
🚨 Default credentials lurking in Dify could leave your database wide open! Anyone could stroll in using the PostgreSQL username and password found in the docker-compose.yaml file. 🔥 Think of it like leaving the front door of your house unlocked with a note that says, 'Come on in, everything’s fine!' It’s an invitation for anyone walking by to take a peek inside and potentially take what they want. An attacker could easily access your PostgreSQL database, potentially leading to full data theft or manipulation. This means they could read, modify, or even delete critical data, making it a recipe for absolute disaster if left unchecked!
Think of it like leaving the front door of your house unlocked with a note that says, 'Come on in, everything’s fine!' It’s an invitation for anyone walking by to take a peek inside and potentially take what they want. This vulnerability allows unauthorized access due to hardcoded default credentials in the docker-compose.yaml file of Dify versions up to 1.5.1, exposing sensitive database information to anyone familiar with the setup.
An attacker could easily access your PostgreSQL database, potentially leading to full data theft or manipulation. This means they could read, modify, or even delete critical data, making it a recipe for absolute disaster if left unchecked! To protect your data, immediately change the default credentials in the docker-compose.yaml file and ensure you’re using secure passwords. Also, consider upgrading to the latest version of Dify to benefit from any security enhancements and best practices. You've got this! Follow these steps to lock down your database and sleep easy knowing your data is safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| langgenius/dify | ≤ 1.5.1 | — |