CVE-2026-55642
CriticalCVSS 9.8Summary
In dbx (prior to 0.5.51), auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset, and the service binds to 0.0.0.0 on port 4224 by default.
Risk Assessment
An unauthenticated network attacker can call /api/connection/connect and /api/query/execute to use configured database credentials and execute arbitrary SQL, potentially leading to disclosure, modification, or destruction of data.
Recommendation
Update dbx to version 0.5.51 or later and ensure DBX_PASSWORD is set.
Original NVD description (English source)
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.