Zero Radar
← feed
CriticalVulnerabilityCVE-2026-77933updated 25 Oct 2026, 15:20 UTC

DB-GPT default setup exposes database with fixed root password

The DB-GPT project ships a setup file with a built-in, unchangeable database password, and the database port is open to the whole network. Anyone who can reach that port can log in as the database administrator and read or change all stored

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker scans networkLooks for open port 3306
  2. 2Port 3306 reachablePublished on all interfaces by default
  3. 3Static root loginHardcoded password in docker-compose.yml
  4. 4Root access gainedLogs in as root@% with FILE and SUPER
  5. ResultAttacker controls the database

What happened

The default docker-compose.yml in DB-GPT through 0.8.2 hardcodes MYSQL_ROOT_PASSWORD and publishes MySQL port 3306 on all interfaces, allowing root@% authentication with FILE and SUPER privileges.

Why it is dangerous: An attacker who reaches port 3306 or the shared dbgptnet network gets full database control, including file and server-level privileges, which can expose stored data and may lead to wider system compromise.

Are you affected?

You are affected if you run DB-GPT version 0.8.2 or earlier using the default docker-compose.yml, especially if port 3306 is reachable from other hosts or networks.

DB-GPT through 0.8.2 (default docker-compose.yml)

What to do

  1. Block external access to port 3306 with a firewall or by removing the published port mapping from docker-compose.yml
  2. Replace the hardcoded MYSQL_ROOT_PASSWORD with a strong, unique password set through an environment file or secret
  3. Check the GitHub advisory GHSA-rq79-8cw2-45h7 for a fixed DB-GPT version and upgrade when available

Timeline

  1. 20 Oct 2026, 01:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-77933 · GHSA-rq79-8cw2-45h7
CVSS
9.3 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 01:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

DB-GPT default setup exposes database with fixed root password · Zero Radar