Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| devpi-server | pip | < 6.20.2 | 6.20.2 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-54723 in devpi-server allowed unauthenticated access to the +changelog route, leading to a database content leak. The core issue was identified in the verify_primary function within devpi_server/replica.py. This function is responsible for ensuring that requests to replication endpoints originate from a valid replica identity.
Upon analyzing the provided commit b4ea49fed4a6233d63f8509c3bf7efafc9b2db17, the patch clearly shows a modification to the verify_primary function. The original code checked if identity is not None and not isinstance(identity, ReplicaIdentity):. This logic was flawed because if identity was None (indicating an unauthenticated request), the first part of the condition (identity is not None) would evaluate to False, causing the entire if statement to be skipped. Consequently, no HTTPForbidden exception was raised for unauthenticated requests.
The fix changed the condition to if not isinstance(self.request.identity, ReplicaIdentity):. This new condition correctly evaluates to True when self.request.identity is None (as isinstance(None, ReplicaIdentity) is False), thereby ensuring that unauthenticated requests are properly rejected with an HTTPForbidden error. Therefore, devpi_server.replica.verify_primary is the precise function that contained the vulnerability, as it failed to enforce the necessary authentication check.
devpi_server.replica.verify_primaryserver/devpi_server/replica.py