CVE-2026-54723

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verifyprimary does not reject a...

CVE-2026-54723

CVE-2026-54723 affects devpi-server , a Python package index staging server. On instances configured with the primary (or deprecated master ) role, a logic bug in verify_primary fails to require ReplicaIdentity, allowing an unauthenticated modified GET request to the +changelog route to disclose ...

CVE-2026-54723 devpi: Database contents leak

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verifyprimary does not reject a...

devpi-web (2.6.0) potentially affected by CVE-2026-54723 via devpi-server (2.6.1)

devpi-server PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on devpi-server and may be impacted: - devpi-web 2.6.0 Source cves: CVE-2026-54723 Source advisory: MEND:CVE-2026-54723...

CVE-2026-54723 devpi: Database contents leak

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verifyprimary does not reject a...

CVE-2026-54723: Missing Critical Step in Authentication

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verifyprimary does not reject a...

PYSEC-2026-3661 devpi-server may leak database contents

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

devpi-web (2.6.0) potentially affected by CVE-2026-54723 via devpi-server (2.6.1)

devpi-server PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on devpi-server and may be impacted: - devpi-web 2.6.0 Source cves: CVE-2026-54723 Source advisory: OSV:PYSEC-2026-3661...

devpi-server may leak database contents

ImpactIf the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

PT-2026-80637

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

devpi-web (2.6.0) potentially affected by CVE-2026-54723 via devpi-server (2.6.1)

devpi-server PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on devpi-server and may be impacted: - devpi-web 2.6.0 Source cves: CVE-2026-54723 Source advisory: OSV:GHSA-M5PQ-69XG-VCQ3...

GHSA-M5PQ-69XG-VCQ3 devpi-server may leak database contents

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

devpi-server may leak database contents

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

Missing Critical Step in Authentication

Overview devpi-server is a devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the +changelog route when the replication protocol is enabled with the primary role. An...

PT-2026-80288

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

PT-2026-80758

Name of the Vulnerable Software and Affected Versions devpi-server versions prior to 6.20.2 devpi-server versions prior to 7.0.0b3 Description A logic bug exists when the replication protocol is enabled using the primary or deprecated master role. An attacker can use a modified GET request to the...

devpi-server (4.1.1) potentially affected by CVE-2024-49769 via waitress (0.9.0)

waitress PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - devpi-server 4.1.1 Source cves: CVE-2024-49769 Source advisory: OSV:PYSEC-2024-211...

devpi-server (4.1.1) potentially affected by CVE-2024-49769 via waitress (0.9.0)

waitress PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - devpi-server 4.1.1 Source cves: CVE-2024-49769 Source advisory: OSV:GHSA-3F84-RPWH-47G6...

devpi-server (4.1.1) potentially affected by CVE-2022-24761 via waitress (0.9.0)

waitress PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - devpi-server 4.1.1 Source cves: CVE-2022-24761 Source advisory: OSV:GHSA-4F7P-27JC-3C36...

devpi-server (4.1.1) potentially affected by CVE-2022-24761 via waitress (0.9.0)

waitress PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - devpi-server 4.1.1 Source cves: CVE-2022-24761 Source advisory: OSV:PYSEC-2022-169...