CVE-2026-55642 in dbx
Summary
by MITRE • 08/20/2026
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in the dbx database client represents a critical authentication bypass flaw within its web interface component, specifically affecting versions prior to 0.5.51. The core technical defect resides in the auth_middleware logic located in crates/dbx-web/src/auth.rs. This middleware is responsible for validating user credentials before allowing access to protected API endpoints. However, under specific configuration conditions where the password_hash variable is None, the middleware fails to enforce authentication checks and instead passes every incoming request directly to the handler chain without verification. This logical error effectively disables security controls for any instance of the service that has not had a password explicitly configured or stored during its initial setup phase.
The operational impact of this vulnerability is severe due to the default configuration behavior of the dbx-web service. Upon a fresh deployment, if the DBX_PASSWORD environment variable is unset and no existing password hash is present in the storage system, the application defaults to an unauthenticated state. Furthermore, by default, crates/dbx-web/src/main.rs binds the web service interface to 0.0.0.0 on port 4224. This binding configuration exposes the vulnerable endpoints to all network interfaces rather than restricting access to local connections only. Consequently, any device or attacker with network connectivity to the host running dbx can interact directly with the application's API without providing valid credentials.
An unauthenticated remote attacker can exploit this flaw by targeting specific API routes such as /api/connection/connect and /api/query/execute. By leveraging these endpoints, an attacker gains full control over the database connections managed by the client. This allows for arbitrary SQL execution against any databases that have been configured within the dbx application. The consequences of unauthorized access include the complete disclosure of sensitive data stored in connected databases, as well as the potential for modification or destruction of critical records through malicious SQL commands. It is important to note that this vulnerability does not affect the desktop Tauri application variant because it binds exclusively to the loopback interface, thereby limiting exposure to local processes only and preventing remote network exploitation.
From a classification perspective, this issue aligns with CWE-287 Improper Authentication, as the system fails to correctly verify identity before granting access to restricted resources. Additionally, the ability of an attacker to execute arbitrary commands via SQL injection techniques maps to ATT&CK technique T1059 Command and Scripting Interpreter, specifically through database command execution vectors like T1190 Exploit Public-Facing Application. The vulnerability stems from a failure in input validation logic regarding authentication state rather than a traditional buffer overflow or memory corruption issue.
To mitigate this risk, organizations must ensure that the dbx-web service is updated to version 0.5.51 or later, where the authentication middleware has been corrected to enforce credential checks even when default configurations are present. For deployments that cannot be immediately patched, it is imperative to explicitly set a strong DBX_PASSWORD environment variable during initialization to prevent the password_hash from remaining None. Additionally, administrators should consider binding the service to 127.0.0.1 instead of 0.0.0.0 if remote access via port 4224 is not strictly required, thereby adding a layer of network-level isolation that prevents external attackers from reaching the vulnerable endpoints even if authentication remains misconfigured.