Summary
CVE-2026-55642 is a critical (CVSS 9.8) authentication bypass in dbx, a cross-platform database client. The dbx-web component’s authentication middleware fails open and passes every protected API request through when no password has been configured, letting unauthenticated network attackers execute arbitrary SQL against connected databases. The flaw affects all versions of dbx-web prior to 0.5.51.
Technical details
- Root cause: The
auth_middlewareincrates/dbx-web/src/auth.rspasses every protected request to the handler chain wheneverpassword_hashisNone. - Trigger conditions: A fresh deployment reaches this state when the
DBX_PASSWORDenvironment variable is unset and no stored password exists yet;crates/dbx-web/src/main.rsbinds the service to0.0.0.0on port 4224 by default, exposing it to the network. - Attack vector: Network, no authentication or user interaction required. An attacker sends requests to
/api/connection/connectand/api/query/executeto leverage the configured database credentials. - Impact: Full disclosure, modification, or destruction of data in any database connected to the exposed dbx-web instance.
- Not affected: The desktop Tauri application variant, which binds only to loopback.
Affected software
- dbx-web (t8y2/dbx), all versions prior to 0.5.51
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE-306: Missing Authentication for Critical Function
Mitigation and recommended actions
- Immediate: Upgrade dbx-web to version 0.5.51 or later, which enforces authentication and returns HTTP 401 on API routes until a password is set.
- If patching is not immediately possible:
- Set the
DBX_PASSWORDenvironment variable before starting the service so a password hash is always configured. - Do not expose dbx-web directly on
0.0.0.0/the public internet; bind it to localhost or restrict access via firewall/network segmentation. - Place the service behind a network control (VPN, allow-list, or reverse proxy requiring authentication) until upgraded.
- Set the
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Page title:
DBX - Raw response body:
dbx-startup-theme,/connection-dialog-legacy.css

