CVE-2026-55642

Name of the Vulnerable Software and Affected Versions dbx versions prior to 0.5.51

Description The auth middleware in crates/dbx-web/src/auth.rs allows protected requests to pass to the handler chain when password hash is None. This state occurs in fresh deployments where DBX PASSWORD is unset and no stored password exists. Since the service binds to 0.0.0.0 on port 4224 by default, an unauthenticated network attacker can access the '/api/connection/connect' and '/api/query/execute' endpoints. This allows the attacker to use configured database credentials to execute arbitrary SQL, potentially leading to the disclosure, modification, or destruction of data in connected databases.

Recommendations Update to version 0.5.51.