CVE-2026-55642
Received Received - Intake

Authentication Bypass in dbx-web Database Client

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-55642
EUVD
EUVD-2026-63470

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
dbx dbx to 0.5.51 (exc)
t8y2 dbx 0.5.51
t8y2 dbx-web 0.5.51

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55642 is a critical unauthenticated arbitrary SQL execution flaw in the dbx-web service. The authentication middleware fails open when no password is configured, allowing all requests to bypass authentication and access sensitive API endpoints like /api/connection/connect and /api/query/execute. This occurs by default when the service is deployed without a password or with weak default credentials (e.g., DBX_PASSWORD=changeme). The dbx-web service binds to all network interfaces (0.0.0.0) by default, making it accessible to any host on port 4224.

Detection Guidance

Check if the dbx-web service is running on port 4224 and bound to 0.0.0.0 using commands like 'netstat -tulnp | grep 4224' or 'ss -tulnp | grep 4224'. Verify if the service is accessible from other hosts. Inspect logs for unauthorized API calls to /api/connection/connect or /api/query/execute.

Impact Analysis

An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands on databases configured in dbx. This could lead to disclosure, modification, or destruction of sensitive data across over 40 supported database engines. The impact includes potential data breaches, unauthorized data manipulation, or complete database compromise. The desktop Tauri application is not affected as it binds only to loopback interfaces.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other data protection regulations. Unauthorized access to sensitive data may result in violations of confidentiality requirements, leading to legal penalties, reputational damage, and loss of trust. Organizations using dbx without proper authentication could face regulatory fines for failing to implement adequate security controls to protect personal or health data.

Mitigation Strategies

Upgrade dbx to version 0.5.51 or later. Set a strong password for dbx-web using DBX_PASSWORD. Bind the service to 127.0.0.1 instead of 0.0.0.0 unless necessary. Restrict network access to port 4224 via firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart