Description
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.
Published: 2026-08-20
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is an authentication bypass in dbx-web’s middleware. When the service starts without the DBX_PASSWORD environment variable and no stored password, the auth_middleware forwards all requests to protected endpoints without verifying credentials. This allows any network user who can reach the service to call the /api/connection/connect and /api/query/execute endpoints and run arbitrary SQL against the database configured for the client, leading to data disclosure, modification, or destruction.

Affected Systems

The issue is present in the t8y2:dbx project, specifically dbx-web versions earlier than 0.5.51. By default, the service binds to 0.0.0.0 on port 4224, exposing it to external networks; the desktop Tauri client is unaffected because it binds only to loopback.

Risk and Exploitability

The CVSS score of 9.8 classifies this vulnerability as critical. No EPSS score is available, but it is not listed in the CISA KEV catalog, and there are no known public exploits. An attacker can exploit the flaw remotely by sending HTTP requests to the exposed port; no authentication is required, lowering the barrier to execution.

Generated by OpenCVE AI on August 20, 2026 at 20:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade dbx to version 0.5.51 or later to re‑enable authentication enforcement on all routes.
  • If an immediate upgrade is not possible, set the environment variable DBX_PASSWORD before launching dbx-web, which forces the middleware to require credentials.
  • Restrict the service’s listening address to loopback or a secure internal network and apply firewall rules to limit exposure of port 4224 to trusted hosts.

Generated by OpenCVE AI on August 20, 2026 at 20:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.
Title dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-20T19:31:10.082Z

Reserved: 2026-06-16T23:52:12.057Z

Link: CVE-2026-55642

cve-icon Vulnrichment

Updated: 2026-08-20T19:30:46.234Z

cve-icon NVD

Status : Received

Published: 2026-08-20T17:18:27.873

Modified: 2026-08-20T20:17:35.697

Link: CVE-2026-55642

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:15:04Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function