Authentication Bypass in dbx Database Client Exposes Sensitive Data
CVE-2026-55642

9.8CRITICAL

Key Information:

Vendor

T8y2

Status
Dbx
Vendor
CVE Published:
20 August 2026

What is CVE-2026-55642?

The dbx database client allows unauthenticated network attackers to exploit a vulnerability in the auth_middleware component. When the password_hash is unset, incoming protected requests can bypass authentication, enabling attackers to access sensitive routes such as /api/connection/connect and /api/query/execute. This exposure allows unauthorized execution of arbitrary SQL commands, potentially leading to data disclosure, modification, or destruction within connected databases. This issue is present in all versions before 0.5.51 and has been mitigated in the latest release.

Affected Version(s)

dbx < 0.5.51

References

https://github.com/t8y2/dbx/security/advisories/GHSA-rqp4...
x_refsource_CONFIRM
https://github.com/t8y2/dbx/issues/2887
x_refsource_MISC
https://github.com/t8y2/dbx/commit/fb919efe0a62869631f492...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.