Read the docs
TI-2026-76663 Aliases CVE-2026-77933

Hardcoded MySQL root credentials in DB-GPT docker-compose deployment

Priority HIGH 81CWE-1392Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

DB-GPT through 0.8.2 from eosphoros-ai ships a default docker-compose.yml with a static MYSQL_ROOT_PASSWORD that publishes port 3306 on all interfaces (CWE-1392). An attacker who can reach port 3306 or the shared dbgptnet network can log in as root and gain full database access. A proof-of-concept exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
eosphoros-aiDB-GPTup to 0.8.2—No fix listedCNA
  • DB-GPT Vendoreosphoros-ai Affected up to 0.8.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for DB-GPT.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-77933
  2. 2026-10-20 CISA SSVC decision points changed
  3. 2026-10-20 Priority changed: MEDIUM → HIGH

References

Exploit 1

Other 1

  • TI-2026-76662 Unauthenticated remote code execution in DB-GPT via agent endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-51243 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header CVSS 4.0CRITICAL 9.3
  • TI-2024-10106 Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
  • TI-2024-10105 Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
  • TI-2024-10044 Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
  • TI-2024-10043 Arbitrary File Write in eosphoros-ai/db-gpt CVSS 3.0CRITICAL 9.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences