Executive brief
devpi-server is a package index and replication server used for Python package management. When database replication is enabled, a configuration available by default in certain deployments, the server exposes its complete database through an unauthenticated endpoint. This includes user password hashes and token authentication secrets. An attacker can extract this data without authentication, potentially gaining unauthorized access to user accounts and compromising the server's authentication system.
Technical details
The vulnerability is a missing authentication check on the +changelog URL route when replication is enabled. When a server instance uses the primary (or deprecated master) role, the changelog endpoint fails to enforce proper access controls, allowing any remote attacker to retrieve the entire database contents via a trivially modified GET request. The leaked data includes user password hashes (using argon2), token IDs, and token salts. While argon2 hashing resists brute-force attacks, dictionary attacks remain feasible. Additionally, the vulnerability can be exploited to cause denial-of-service by generating massive CPU, I/O, and bandwidth usage. The root cause is a logic bug in access control enforcement. The issue is patched in devpi-server 6.20.2 and 7.0.0b3. Workarounds include disabling replication by setting the role to standalone, or deploying behind nginx with the devpi-lockdown plugin.
Affected products
- devpi devpi-server < 6.20.2
Timeline
- 2026-06-11: disclosed
- 2026-08-18: advisory
- 2026-06-11: patched: Patches released as devpi-server 6.20.2 and 7.0.0b3