Advisories for Golang/Github.com/Anipaleja/Nginx-Defender package

2025

Default Credentials in nginx-defender Configuration Files

This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml, docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. Who is impacted? All users who deploy nginx-defender with default credentials and expose the admin interface to untrusted networks.