CVE-2025-55740 Default Credentials in nginx-defender Configuration Files
Attackers can gain administrative control of nginx-defender deployments using default credentials found in example configuration files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55740?
CVE-2025-55740 is a medium-severity vulnerability in Anipaleja nginx-defender, published on 19 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.
Weakness: CWE-1392
Which versions are affected by CVE-2025-55740?
3 open source packages ship an affected version, including github.com/Anipaleja/nginx-defender.
| Package | Affected | Fixed in |
|---|---|---|
github.com/Anipaleja/nginx-defender Go | All versions | 1.5.0 |
github.com/Anipaleja/nginx-defender Go | All versions | 1.5.0 |
github.com/Anipaleja/nginx-defender Go | All versions | 1.5.0 |
How do I fix CVE-2025-55740?
Upgrade github.com/Anipaleja/nginx-defender to 1.5.0 or later.
Is CVE-2025-55740 being exploited?
There is no known exploitation of CVE-2025-55740 in the wild and no public exploit code.
Sources
Also known as GHSA-pr72-8fxw-xx22, GO-2025-3896.