CVE-2026-55642: CWE-306: Missing Authentication for Critical Function in t8y2 dbx
Description
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.
CVSS v3.1
Score 9.8critical
Affected software
t8y2
dbx
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in t8y2 dbx occurs because the authentication middleware in dbx-web (crates/dbx-web/src/auth.rs) passes all protected requests to the handler chain when password_hash is None. This state happens on fresh deployments with DBX_PASSWORD unset and no stored password. The service binds to 0.0.0.0 on port 4224 by default, exposing it to network attackers. Exploitation allows unauthenticated attackers to call critical API routes to connect to configured databases and execute arbitrary SQL commands, risking full compromise of connected database data. The desktop Tauri client is unaffected due to its local-only binding. The vulnerability is resolved in version 0.5.51.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands on connected databases, leading to potential disclosure, modification, or destruction of sensitive data. The vulnerability affects network-exposed deployments where no password is set, significantly increasing risk. The CVSS score of 9.8 reflects the critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in t8y2 dbx version 0.5.51. Users should upgrade to version 0.5.51 or later to remediate the issue. Until upgrading, ensure that the DBX_PASSWORD environment variable is set and that the service is not exposed to untrusted networks. The desktop Tauri application is not affected and requires no action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T23:52:12.057Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8730d9acd9273b49e1718b
Added to database: 08/20/2026, 16:52:41 UTC
Last enriched: 08/20/2026, 17:08:01 UTC
Last updated: 10/04/2026, 18:53:17 UTC
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.