Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

devpi-server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5PyPIPublished

    devpi-server may leak database contents

    CVE-2026-54723 · GHSA-m5pq-69xg-vcq3

    Affected
    • PyPI devpi-server < 6.20.2
    Fixed in
    6.20.2· Vendor fix available
    Issue
    Impact If the replication protocol is enabled by using the primary (or deprecated master) role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially modified GET request. The leaked hashes use the argon2 algorithm, so they are not immediately at risk by brute-force methods, but dictionary attacks are feasible. If a database leak could have happened, it is advised to change the passwords after a patched version or other mitigation is in place. When devpi-tokens is in use, the quality of the server secret is important. It might be possible to derive the server secret if actual tokens are public by using similar techniques to finding the password for a hash. If a database leak could have happened and any tokens are public, it is advised to change the server secret. Besides the information leak this can be used to produce significant CPU, IO…

    Recommended action: Upgrade to 6.20.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →