CVE-2025-56157 describes a critical vulnerability in Dify up to version 1.5.1 where default PostgreSQL usernames and passwords are specified in the docker-compose.yaml file included in the source code. This constitutes a CWE-798 (Use of Hard-coded Credentials) weakness. The supplier notes that from version 1.0.1 onward, the Docker configuration does not expose PostgreSQL on TCP port 5432 by default, reducing exposure risk. However, if PostgreSQL is reachable, the default credentials allow unauthenticated attackers to fully compromise the database. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

If an attacker can access the PostgreSQL service, the default credentials allow full unauthorized access, leading to complete compromise of the database's confidentiality, integrity, and availability. This can result in data theft, data manipulation, or denial of service. The risk is mitigated if the PostgreSQL port is not exposed externally, as stated by the supplier for versions 1.0.1 and later.

No official patch or fix is currently documented. Users should ensure that PostgreSQL is not exposed externally, as per the supplier's configuration starting from version 1.0.1. Additionally, users must change default credentials immediately if the database is accessible to prevent unauthorized access. Monitor vendor advisories for any forthcoming official fixes or updates.