CVE-2025-55740

nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.

The following products are affected by CVE-2025-55740 vulnerability.

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-55740.

URL	Resource
https://github.com/Anipaleja/nginx-defender/security/advisories/GHSA-pr72-8fxw-xx22