DB-GPT · CVE-2026-123018 · AI agents & MCP
NO FIX YET
DB-GPT CodeAction (execute_code in code_utils.py) runs LLM-generated code blocks natively in the server process. Per the reporter's GitHub issue #3287 (open, no maintainer reply), the official Docker image skips the sandbox and the default API needs no authentication, so a remote attacker can get code run. The reporter demonstrated a file write. No fixed version exists; v0.8.2 is the latest release. Mitigation suggested by the reporter: restrict port 5670, avoid CodeEngineer/CodeAction apps, and put an authenticating proxy in front.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted DB-GPT up to 0.8.2 where the API is reachable by untrusted users. The reporter says the default config has no authentication (api_keys empty, port 5670 on 0.0.0.0), so someone can create a CodeEngineer agent app and make the LLM emit code that CodeAction runs inside the server process. In the official Docker image the built-in sandbox is skipped because of a /.dockerenv check. Deployments behind an authenticating proxy or on a private network are much less exposed. This comes from the reporter's issue; the maintainers have not confirmed it.
Not affected if auth-required, network-restricted, newer-version
Who cares ai-agents, db-gpt, docker, python, self-hosted
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.