A medium severity vulnerability, CVE-2026-54723 with a CVSS score of 6.5, exists in the replication protocol of devpi-server that allows an attacker to read the complete database content including password hashes and token IDs and salts by exploiting a logic bug in the +changelog URL route when using the primary role for a server instance. This flaw enables dictionary attacks on passwords and potentially allows derivation of the server secret if tokens are public, resulting in significant CPU, IO, and bandwidth usage depending on the database size. The issue affects versions prior to 6.20.2 and can be mitigated by setting the role to standalone or using a lockdown plugin with nginx; it is recommended to change passwords and the server secret after a patched version is in place.
We recommend you to update devpi-server to version 6.20.2.[/subscribe_to_unlock_form]
A medium severity vulnerability, CVE-2026-54723 with a CVSS score of 6.5, exists in the replication protocol of devpi-server that allows an attacker to read the complete database content including password hashes and token IDs and salts by exploiting a logic bug in the +changelog URL route when using the primary role for a server instance. This flaw enables dictionary attacks on passwords and potentially allows derivation of the server secret if tokens are public, resulting in significant CPU, IO, and bandwidth usage depending on the database size. The issue affects versions prior to 6.20.2 and can be mitigated by setting the role to standalone or using a lockdown plugin with nginx; it is recommended to change passwords and the server secret after a patched version is in place.
We recommend you to update devpi-server to version 6.20.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]