CVE-2026-54723

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54723
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54723.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54723
Aliases
Published
2026-09-14T17:41:23Z
Modified
2026-09-16T03:46:58Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
devpi: Database contents leak
Details

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verify_primary does not reject a missing identity and therefore fails to require ReplicaIdentity. The response can disclose complete database content, including Argon2 password hashes and identifiers and salts for devpi-tokens; exposed hashes may be subject to dictionary attacks, and public tokens may assist attempts to derive the server secret. Large responses can also consume significant CPU, input/output capacity, and bandwidth. Servers using the standalone role are not exposed through replication, and an instance served exclusively through nginx with devpi-lockdown redirects the request to login with no known exploit. This issue is fixed in devpi-server versions 6.20.2 and 7.0.0b3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-304"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54723.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.0.0b1"
                },
                {
                    "fixed": "7.0.0b3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/devpi/devpi

Affected ranges

Type
GIT
Repo
https://github.com/devpi/devpi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b4ea49fed4a6233d63f8509c3bf7efafc9b2db17
Fixed
4200f9929982cb37aca14e12d70dacadba7b3397
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.20.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.9
0.9.1
0.9.2
0.9.3
0.9.4
1.*
1.0
1.0rc1
1.1
1.2
1.2.1
1.2.2
2.*
2.0.0
2.1.0
2.5.3
client-2.*
client-2.0.1
client-2.0.2
client-2.0.3
client-2.0.4
client-2.0.5
client-2.1.0
client-2.3.0
client-2.3.1
client-2.3.2
client-2.4.0
client-2.4.1
client-2.6.0
client-2.6.1
client-2.6.2
client-2.6.3
client-2.6.4
client-2.7.0
client-3.*
client-3.0.0
client-3.1.0
client-4.*
client-4.0.0
client-4.0.1
client-4.0.2
client-4.0.3
client-4.1.0
client-4.2.0
client-4.3.0
client-4.4.0
client-5.*
client-5.1.0
client-5.1.1
client-5.2.0
client-5.2.1
client-5.2.2
client-5.2.3
client-6.*
client-6.0.0
client-6.0.1
client-6.0.2
client-6.0.3
client-6.0.4
client-6.0.5
client-6.0.6
client-7.*
client-7.0.0
client-7.0.1
client-7.0.2
client-7.0.3
client-7.1.0
client-7.2.0
client-7.2.1
client-7.3.0
common-2.*
common-2.0.2
common-2.0.3
common-2.0.4
common-2.0.5
common-2.0.7
common-2.0.8
common-3.*
common-3.0.0
common-3.0.1
common-3.1.0
common-3.2.0
common-3.2.1
common-3.2.2
common-3.2.3
common-3.3.0
common-3.3.1
common-3.3.2
common-3.5.0
common-3.6.0
common-3.7.0
common-3.7.1
common-3.7.2
common-4.*
common-4.0.0
common-4.0.1
common-4.0.2
common-4.0.3
common-4.0.4
common-4.1.0
common-4.1.1
devpi-2.*
devpi-2.0.2
devpi-2.0.3
docs-4.*
docs-4.4
postgresql-0.*
postgresql-0.1.1
postgresql-0.2.0
postgresql-0.3.0
postgresql-1.*
postgresql-1.0.0
postgresql-1.1.0
postgresql-2.*
postgresql-2.0.0
postgresql-3.*
postgresql-3.0.0
postgresql-3.0.1
server-1.*
server-1.2.2
server-2.*
server-2.0.1
server-2.0.2
server-2.0.5
server-2.0.6
server-2.1.0
server-2.1.1
server-2.1.2
server-2.1.3
server-2.1.4
server-2.1.5
server-2.2.1
server-2.2.2
server-2.3.0
server-2.3.1
server-2.4.0
server-2.5.0
server-2.5.1
server-2.5.2
server-2.5.3
server-2.6.0
server-2.6.1
server-3.*
server-3.1.0
server-3.1.1
server-4.*
server-4.0.0
server-4.1.0
server-4.1.1
server-4.2.0
server-4.2.1
server-4.3.0
server-4.3.1
server-4.3.2
server-4.4.0
server-4.5.0
server-4.6.0
server-4.7.0
server-4.7.1
server-4.8.0
server-4.8.1
server-4.9.0
server-5.*
server-5.1.0
server-5.2.0
server-5.3.0
server-5.3.1
server-5.4.0
server-6.*
server-6.0.0
server-6.0.1
server-6.1.0
server-6.10.0
server-6.11.0
server-6.12.0
server-6.12.1
server-6.13.0
server-6.14.0
server-6.15.0
server-6.16.0
server-6.17.0
server-6.18.0
server-6.19.0
server-6.19.1
server-6.19.2
server-6.19.3
server-6.2.0
server-6.20.0
server-6.20.1
server-6.3.0
server-6.3.1
server-6.4.0
server-6.5.0
server-6.5.1
server-6.6.0
server-6.6.1
server-6.7.0
server-6.8.0
server-6.9.0
server-6.9.1
server-6.9.2
web-2.*
web-2.0.1
web-2.1.0
web-2.1.1
web-2.2.0
web-2.2.1
web-2.2.2
web-2.2.3
web-2.4.0
web-2.4.1
web-2.4.2
web-2.5.0
web-2.6.0
web-3.*
web-3.1.0
web-3.1.1
web-3.2.0
web-3.2.1
web-3.2.2
web-3.3.0
web-3.4.0
web-3.4.1
web-3.5.0
web-3.5.1
web-4.*
web-4.0.0
web-4.0.1
web-4.0.2
web-4.0.3
web-4.0.4
web-4.0.5
web-4.0.6
web-4.0.7
web-4.0.8
web-4.1.0
web-4.1.1
web-4.2.0
web-4.2.1
web-4.2.2
web-4.2.3
web-4.3.0
web-5.*
web-5.0.0
web-5.0.1
web-5.0.2
web-5.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54723.json"