T09 · Insecure Skill Coding Practices
- Location
docker-compose.yml:6- Finding
Predictable Default Credentials for the pgAdmin Administrative Interface
- Content
View full analysis
Vulnerability Details
File Location:
docker-compose.yml, lines 6-9
Related Documentation:SKILL.md, lines 42-48 and 60-63
Vulnerability Type: Hard-coded and publicly documented default credentials
Risk Level: MediumVulnerable Code
yaml environment: PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:-admin@codai.local} PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD:-pgadmin} PGADMIN_LISTEN_PORT: 80The associated documentation explicitly discloses the default pgAdmin and PostgreSQL credentials:
text Open `http://localhost:8082` in a browser. Login: `admin@codai.local` / `pgadmin`. To connect to PostgreSQL inside pgAdmin, add a server with: - **Host**: `codai_postgres` - **Port**: `5432` - **User**: `codai` / **Password**: `pgpass`Technical Analysis
The Compose configuration falls back to the predictable password
pgadminwheneverPGADMIN_PASSWORDis not explicitly supplied. Because the installation documentation publishes this default, it must be treated as a known credential rather than a secret.Although the host port is bound to
127.0.0.1, the service also joins the externalnginx-proxy_netDocker network. Consequently, the interface may be reachable both from the host and from other containers with access to that shared network. Loopback binding reduces remote exposure but does not protect against malicious local users, compromised host processes, browser-based attacks that can reach local services, or untrusted containers on the external network.The documentation also publishes a predictable PostgreSQL password. If that credential is active in the related PostgreSQL deployment, an attacker who reaches pgAdmin or the database service can attempt direct database authentication.
Attack Path
- A user starts the Skill without setting
PGADMIN_PASSWORD. - Docker Compose initializes pgAdmin with
admin@codai.localand the known passwordpgadmin. ...[truncated 1210 chars]
- A user starts the Skill without setting
- Remediation
View remediation
Remediation Suggestions
-
Remove the default password and require an explicitly supplied secret:
yaml environment: PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:?PGADMIN_EMAIL must be set} PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD:?PGADMIN_PASSWORD must be set} PGADMIN_LISTEN_PORT: 80 -
Generate a unique, high-entropy password for each deployment and place it in a protected secret store, Docker secret, or environment file with restrictive filesystem permissions.
-
Remove all plaintext passwords from
SKILL.md. Document placeholder values and a secure secret-generation process instead. -
Rotate the pgAdmin and PostgreSQL passwords for existing deployments because the current defaults are publicly known.
-
Restrict membership in the external Docker network and avoid attaching unrelated or untrusted containers to it.
-
Apply network-level filtering or use a dedicated internal network when direct communication with unrelated proxy containers is unnecessary.
-
Assign the PostgreSQL user only the minimum database privileges required and use a separate administrative account for privileged maintenance.
-
Consider adding authentication rate limiting and reviewing pgAdmin access logs for attempts using the published credentials.
-