dify - 💡(How to fix) Fix CRITICAL: Hardcoded default credentials for Redis, DB, Sandbox, Plugin Daemon — EMPTY SECRET_KEY

CWE-798: Hardcoded Default Credentials in .env.example — Multiple Services

Severity: CRITICAL (CVSS 9.8)

Location

api/.env.example:

Description

The .env.example file ships with hardcoded default credentials for nearly every service:

SECRET_KEY=                                                   ← EMPTY
REDIS_PASSWORD=difyai123456                                   ← hardcoded
DB_PASSWORD=difyai123456                                      ← hardcoded
CELERY_BROKER_URL=redis://:difyai123456@localhost:${REDIS_PORT}/1  ← hardcoded
WEAVIATE_API_KEY=WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih        ← hardcoded
SANDBOX_API_KEY=dify-sandbox                                  ← hardcoded
CODE_EXECUTION_API_KEY=dify-sandbox                           ← hardcoded
PLUGIN_DAEMON_KEY=lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi  ← hardcoded
INNER_API_KEY_FOR_PLUGIN=QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1  ← hardcoded

Also in docker-compose.yaml:

POSTGRES_PASSWORD: ${DB_PASSWORD:-difyai123456}
REDISCLI_AUTH: ${REDIS_PASSWORD:-difyai123456}
MYSQL_ROOT_PASSWORD: ${DB_PASSWORD:-difyai123456}

Impact

• EMPTY SECRET_KEY: JWT tokens, session cookies, CSRF tokens are trivially forgeable. Any attacker can generate valid admin session tokens.
• Hardcoded Redis password: If Redis is exposed, attacker gets full data access
• Hardcoded DB password: Full database compromise
• Hardcoded plugin daemon key: Attacker can deploy malicious plugins
• Hardcoded inner API key: Attacker can bypass API authentication
• Users who deploy without changing defaults are immediately vulnerable

Remediation

1. Replace all hardcoded values with CHANGE_ME or empty strings
2. Require SECRET_KEY to be non-empty on startup
3. Add startup validation that rejects known default passwords
4. Add documentation emphasizing these MUST be changed