CVE-2026-54723
Received Received - Intake

Information Disclosure in devpi-server

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verify_primary does not reject a missing identity and therefore fails to require ReplicaIdentity. The response can disclose complete database content, including Argon2 password hashes and identifiers and salts for devpi-tokens; exposed hashes may be subject to dictionary attacks, and public tokens may assist attempts to derive the server secret. Large responses can also consume significant CPU, input/output capacity, and bandwidth. Servers using the standalone role are not exposed through replication, and an instance served exclusively through nginx with devpi-lockdown redirects the request to login with no known exploit. This issue is fixed in devpi-server versions 6.20.2 and 7.0.0b3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54723
EUVD
EUVD-2026-77701

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
devpi devpi-server to 7.0.0b3 (exc)
devpi devpi-server to 7.0.0b3 (inc)
devpi devpi-server to 6.20.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-304 The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54723 is a vulnerability in the devpi-server package where an unauthenticated attacker can send a modified GET request to the +changelog route. This exploits a missing identity check in the replication protocol, allowing access to the complete database contents including Argon2 password hashes and token salts. The issue affects servers configured with primary or deprecated master roles.

Detection Guidance

Check if your devpi-server version is below 6.20.2 or 7.0.0b3. Monitor network traffic for GET requests to the +changelog route. Inspect logs for unusual database access patterns or large response sizes.

Impact Analysis

An attacker could obtain sensitive data like password hashes and token salts, potentially leading to unauthorized access or dictionary attacks. The leak may also consume significant server resources, causing performance issues. If replication is enabled, changing passwords and server secrets is recommended.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, including password hashes and tokens, which may violate GDPR's data protection requirements for confidentiality and integrity. For HIPAA, exposure of such data could compromise protected health information if stored in the system.

Mitigation Strategies

Upgrade devpi-server to version 6.20.2 or 7.0.0b3. Disable replication if not needed. If using nginx, enable devpi-lockdown to redirect unauthorized requests. Change all Argon2 password hashes and devpi-tokens if a leak is suspected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54723. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart