CVE-2026-54723

CVE-2026-54723 affects devpi-server , a Python package index staging server. On instances configured with the primary (or deprecated master ) role, a logic bug in verify_primary fails to require ReplicaIdentity, allowing an unauthenticated modified GET request to the +changelog route to disclose ...