Zero Radar
← feed
CriticalVulnerabilityCVE-2026-77932updated 25 Oct 2026, 15:20 UTC

DB-GPT: unauthenticated attackers can run commands on the server

Anyone who can reach the DB-GPT web service can make it run computer commands on the server without logging in. That can give them full control of the machine and the database it stores.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends promptNo login needed; endpoint trusts all callers
  2. 2Agent endpointMock check grants every caller admin role
  3. 3Code tools runUnsandboxed Python or bash runs as root
  4. 4Database reachedDefault credentials allow access
  5. ResultAttacker controls the webserver container

What happened

In DB-GPT through 0.8.2, the /api/v1/chat/react-agent endpoint uses a mock get_user_from_headers function that grants every caller the admin role. The ReAct agent's code_interpreter and shell_interpreter tools run without a sandbox, so crafted prompts can execute arbitrary Python or bash as root in the webserver container.

Why it is dangerous: Attackers need no account or password, can run code as root inside the webserver container, and can reach the bundled database using its default credentials. Any internet-exposed DB-GPT deployment is at risk.

Are you affected?

You are affected if you run DB-GPT version 0.8.2 or earlier with the web service reachable by others, including over the internet or an untrusted internal network.

DB-GPT through 0.8.2

What to do

  1. Restrict network access to the DB-GPT web endpoint so only trusted users can reach it
  2. Check whether the /api/v1/chat/react-agent endpoint is exposed and disable or block it if you do not need it
  3. Change the default database credentials and review the container for signs of unexpected commands
  4. Update DB-GPT to a version newer than 0.8.2 once a fixed release is available

Timeline

  1. 20 Oct 2026, 01:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-77932 · GHSA-5vjv-vw3m-qpqp
CVSS
9.3 / 10
EPSS
0.8% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 01:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

DB-GPT: unauthenticated attackers can run commands on the server · Zero Radar