CVE-2026-54723

Name of the Vulnerable Software and Affected Versions devpi-server versions prior to 6.20.2 devpi-server versions prior to 7.0.0b3

Description A logic bug exists when the replication protocol is enabled using the primary (or deprecated master) role. An attacker can use a modified GET request to the +changelog URL route to read the entire database content. This leaked information includes password hashes and the IDs and salts of tokens from devpi-tokens. The password hashes utilize the argon2 algorithm, which protects against brute-force but remains susceptible to dictionary attacks. Additionally, if tokens are public, the server secret could potentially be derived. This issue can also lead to significant CPU, IO, and bandwidth consumption depending on the database size.

Recommendations Update devpi-server to version 6.20.2 or later. Update devpi-server to version 7.0.0b3 or later. Set the server role to standalone if replication is not required. Change all passwords if a database leak is suspected. Change the server secret if a database leak occurred and any tokens are public.