{"id":"CVE-2026-54723","summary":"devpi: Database contents leak","details":"devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verify_primary does not reject a missing identity and therefore fails to require ReplicaIdentity. The response can disclose complete database content, including Argon2 password hashes and identifiers and salts for devpi-tokens; exposed hashes may be subject to dictionary attacks, and public tokens may assist attempts to derive the server secret. Large responses can also consume significant CPU, input/output capacity, and bandwidth. Servers using the standalone role are not exposed through replication, and an instance served exclusively through nginx with devpi-lockdown redirects the request to login with no known exploit. This issue is fixed in devpi-server versions 6.20.2 and 7.0.0b3.","aliases":["GHSA-m5pq-69xg-vcq3","PYSEC-2026-3661"],"modified":"2026-09-16T03:46:58.246802807Z","published":"2026-09-14T17:41:23.451Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-304"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54723.json","unresolved_ranges":[{"extracted_events":[{"introduced":"7.0.0b1"},{"fixed":"7.0.0b3"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://github.com/devpi/devpi/releases/tag/server-6.20.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54723.json"},{"type":"ADVISORY","url":"https://github.com/devpi/devpi/security/advisories/GHSA-m5pq-69xg-vcq3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54723"},{"type":"FIX","url":"https://github.com/devpi/devpi/commit/b4ea49fed4a6233d63f8509c3bf7efafc9b2db17"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/devpi/devpi","events":[{"introduced":"0"},{"fixed":"b4ea49fed4a6233d63f8509c3bf7efafc9b2db17"},{"fixed":"4200f9929982cb37aca14e12d70dacadba7b3397"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.20.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["server-6.20.1","web-5.1.0","server-6.20.0","client-7.3.0","server-6.19.3","web-5.0.2","server-6.19.2","client-7.2.1","server-6.19.1","common-4.1.1","server-6.19.0","server-6.18.0","server-6.17.0","server-6.16.0","web-5.0.1","web-5.0.0","server-6.15.0","common-4.1.0","web-4.3.0","server-6.14.0","client-7.2.0","web-4.2.3","server-6.13.0","server-6.12.1","client-7.1.0","server-6.12.0","web-4.2.2","server-6.11.0","common-4.0.4","client-7.0.3","server-6.10.0","common-4.0.3","client-6.0.6","client-7.0.2","common-4.0.2","client-7.0.1","common-4.0.1","common-4.0.0","client-7.0.0","server-6.9.2","web-4.2.1","server-6.9.1","client-6.0.5","server-6.9.0","client-6.0.4","client-6.0.3","common-3.7.2","common-3.7.1","web-4.2.0","server-6.8.0","web-4.1.1","server-6.7.0","client-6.0.2","server-6.6.1","web-4.1.0","server-6.6.0","common-3.7.0","client-6.0.1","client-6.0.0","server-6.5.1","postgresql-3.0.1","server-6.5.0","postgresql-3.0.0","server-6.4.0","server-6.3.1","server-6.3.0","client-5.2.3","web-4.0.8","server-6.2.0","web-4.0.7","server-6.1.0","server-6.0.1","server-6.0.0","web-4.0.6","client-5.2.2","common-3.6.0","client-5.2.1","web-4.0.5","web-4.0.4","web-4.0.3","common-3.5.0","client-5.2.0","postgresql-2.0.0","web-4.0.2","server-5.4.0","postgresql-1.1.0","web-4.0.1","client-5.1.1","server-5.3.1","server-5.3.0","client-5.1.0","web-4.0.0","server-5.2.0","server-5.1.0","web-3.5.1","server-4.9.0","postgresql-1.0.0","client-4.4.0","common-3.3.2","server-4.8.1","client-4.3.0","web-3.5.0","server-4.8.0","client-4.2.0","web-3.4.1","common-3.3.1","server-4.7.1","client-4.1.0","postgresql-0.3.0","web-3.4.0","server-4.7.0","common-3.3.0","server-4.6.0","client-4.0.3","web-3.3.0","server-4.5.0","common-3.2.3","client-4.0.2","common-3.2.2","client-4.0.1","common-3.2.1","docs-4.4","web-3.2.2","server-4.4.0","postgresql-0.2.0","client-4.0.0","server-4.3.2","postgresql-0.1.1","web-3.2.1","server-4.3.1","common-3.2.0","client-3.1.0","web-3.2.0","server-4.3.0","client-3.0.0","common-3.1.0","server-4.2.1","server-4.2.0","server-4.1.1","client-2.7.0","client-2.6.4","server-4.1.0","web-3.1.1","common-3.0.1","client-2.6.3","common-3.0.0","server-4.0.0","server-3.1.1","client-2.6.2","client-2.6.1","server-3.1.0","web-3.1.0","client-2.6.0","server-2.6.1","client-2.4.1","web-2.6.0","server-2.6.0","client-2.4.0","server-2.5.3","2.5.3","server-2.5.2","server-2.5.1","web-2.5.0","server-2.5.0","web-2.4.2","server-2.4.0","common-2.0.8","client-2.3.2","common-2.0.7","server-2.3.1","web-2.4.1","client-2.3.1","server-2.3.0","client-2.3.0","server-2.2.2","web-2.4.0","server-2.2.1","client-2.1.0","server-2.1.5","client-2.0.5","common-2.0.5","server-2.1.4","web-2.2.3","server-2.1.3","client-2.0.4","web-2.2.2","common-2.0.4","web-2.2.1","server-2.1.2","server-2.1.1","web-2.2.0","server-2.1.0","common-2.0.3","client-2.0.3","2.1.0","server-2.0.6","web-2.1.1","devpi-2.0.3","web-2.1.0","common-2.0.2","client-2.0.2","server-2.0.5","devpi-2.0.2","web-2.0.1","client-2.0.1","server-2.0.2","server-2.0.1","2.0.0","1.2.2","server-1.2.2","1.2.1","1.2","1.1","1.0","1.0rc1","0.9.4","0.9.3","0.9.2","0.9.1","0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54723.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}]}