Issue Station
Sign In
Tools hereToolbox

litellm - 💡(How to fix) Fix HIGH: Database password hardcoded as dbpassword9090 in docker-compose.yml

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

The PostgreSQL database password is hardcoded as dbpassword9090 in the docker-compose file. This database stores:

  • All provider API keys (OpenAI, Anthropic, Azure, etc.)
  • User API keys and access tokens
  • Audit logs and usage data
  • Cost tracking information
  • Model configurations and routing rules

Root Cause

The PostgreSQL database password is hardcoded as dbpassword9090 in the docker-compose file. This database stores:

  • All provider API keys (OpenAI, Anthropic, Azure, etc.)
  • User API keys and access tokens
  • Audit logs and usage data
  • Cost tracking information
  • Model configurations and routing rules
RAW_BUFFERClick to expand / collapse

CWE-798: Hardcoded Database Password in docker-compose.yml

Severity: HIGH (CVSS 7.5)

Location

+ '' + docker-compose.yml + '' + :

DATABASE_URL: "postgresql://llmproxy:dbpassword9090@db:5432/litellm" POSTGRES_PASSWORD: dbpassword9090

Description

The PostgreSQL database password is hardcoded as dbpassword9090 in the docker-compose file. This database stores:

  • All provider API keys (OpenAI, Anthropic, Azure, etc.)
  • User API keys and access tokens
  • Audit logs and usage data
  • Cost tracking information
  • Model configurations and routing rules

Impact

Combined with the sk-1234 master key, an attacker with database access can dump every stored API key and credential, pivot to all downstream LLM providers, and exfiltrate months of usage data.

Remediation

  1. Remove hardcoded password from docker-compose.yml
  2. Use ${POSTGRES_PASSWORD:-} with no default
  3. Generate a random password during setup
  4. Add the .env with defaults for docker-compose instead of hardcoding

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

litellm - 💡(How to fix) Fix HIGH: Database password hardcoded as dbpassword9090 in docker-compose.yml