CVE-2026-54723

Unauthenticated GET to +changelog leaks DB data and password hashes.

• CVSS 6.5
• 304
• Information Leakage
• Remote

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verify_primary does not reject a missing identity and therefore fails to require ReplicaIdentity. The response can disclose complete database content, including Argon2 password hashes and identifiers and salts for devpi-tokens; exposed hashes may be subject to dictionary attacks, and public tokens may assist attempts to derive the server secret. Large responses can also consume significant CPU, input/output capacity, and bandwidth. Servers using the standalone role are not exposed through replication, and an instance served exclusively through nginx with devpi-lockdown redirects the request to login with no known exploit. This issue is fixed in devpi-server versions 6.20.2 and 7.0.0b3.

CVE

CVE-2026-54723

CWE

304

CVSS base score

6.5

Published

2026-09-14

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

devpi

Fixed by upgrading

Yes

Solution

Upgrade devpi‑server to version 6.20.2 (or later, e.g., 7.0.0b3).

from devpi_server.views import verify_primary

def get_changelog(request):
    # VULNERABLE: missing identity check allows unauthenticated access
    if not verify_primary(request):
        return request.redirect('/+login')
    return request.db.execute('SELECT * FROM changelog')

from devpi_server.views import verify_primary

def get_changelog(request):
    # FIX: ensure request has an identity before allowing access
    if not getattr(request, 'identity', None) or not verify_primary(request):
        return request.redirect('/+login')
    return request.db.execute('SELECT * FROM changelog')

@misc{vaitp:cve202654723,
  title        = {{Unauthenticated GET to +changelog leaks DB data and password hashes.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-54723},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-54723/}}
}