---
id: "CVE-2026-121455"
kind: "vulnerability"
aliases: ["CVE-2026-121455"]
title: "DbGate: connection-restricted users can probe hosts and overwrite saved connections"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["databases", "dbgate", "package", "self-hosted"]
not_affected_if: ["no-connection-restrictions", "single-user-instance"]
published_at: "2026-11-03T16:17:24+00:00"
first_seen_at: "2026-11-03T16:21:43+00:00"
updated_at: "2026-11-03T16:24:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121455", "first_seen_at": "2026-11-03T16:21:43+00:00"}]
---

# DbGate: connection-restricted users can probe hosts and overwrite saved connections

DbGate before 7.3.3 does not check connection permissions on its test and save endpoints, so a user limited to certain connections can bypass that restriction. An attacker with such an account can probe internal database hosts through the test endpoint and overwrite stored connection definitions through the save endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DbGate version against `7.3.3`; anything earlier is in scope.
- Look for `LOGIN_PERMISSIONS` restrictions in the deployment configuration and whether any users are limited to specific connections.
- Review who holds accounts on the DbGate instance.

## Fix

- Move to `7.3.3` or later.

## Timeline

- 2026-11-03T16:21:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121455

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dbgate-before-7.3.3-missing-authorization-via-connections-test-and-connections-save
- [fix] Patch: github.com https://github.com/dbgate/dbgate/commit/9166a987bfec

## From the sources

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_