Unauthenticated remote code execution in DB-GPT via agent endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
DB-GPT through 0.8.2 has a missing authentication flaw (CWE-306) because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that gives every caller the admin role. An unauthenticated remote attacker can send prompts that make the agent's unsandboxed code and shell interpreter tools run arbitrary Python or bash as root in the webserver container. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| eosphoros-ai | DB-GPT | up to 0.8.2 | — | No fix listed | CNA |
- DB-GPT Vendoreosphoros-ai Affected up to 0.8.2 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for DB-GPT.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-20 Threatist record created from CVE-2026-77932
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: MEDIUM → HIGH
- 2026-10-21 EPSS moved to the 50th–90th percentile
References
Exploit 1
Other 2
- https://github.com/eosphoros-ai/DB-GPT/blob/83609c471266607490b24e72188311efa23a0d16/packages/dbgpt-serve/src/dbgpt_serve/utils/auth.py#L25
- https://github.com/eosphoros-ai/DB-GPT/blob/83609c471266607490b24e72188311efa23a0d16/packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/tools/code_interpreter.py#L39
More eosphoros-ai vulnerabilities
- TI-2026-76663 Hardcoded MySQL root credentials in DB-GPT docker-compose deployment CVSS 4.0CRITICAL 9.3
- TI-2026-51243 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header CVSS 4.0CRITICAL 9.3
- TI-2024-10106 Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
- TI-2024-10105 Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
- TI-2024-10044 Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
- TI-2024-10043 Arbitrary File Write in eosphoros-ai/db-gpt CVSS 3.0CRITICAL 9.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences