CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2025-55740
Medium (6.5). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/Anipaleja/nginx-defender 1.5.0.
nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files
config.yaml and docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1392
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pr72-8fxw-xx22 | Go | github.com/Anipaleja/nginx-defender | <1.5.0 | 1.5.0 |
| GO-2025-3896 | Go | github.com/Anipaleja/nginx-defender | <1.5.0 | 1.5.0 |