{"id":"CVE-2026-77932","kind":"vulnerability","aliases":["CVE-2026-77932"],"related":[],"title":"DB-GPT: unauthenticated endpoint lets any caller run code as root","description":"DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.","summary":"DB-GPT's /api/v1/chat/react-agent endpoint treats every caller as an admin because its user check is a mock, so anyone on the network can send prompts that drive unsandboxed Python and bash tools. An attacker gets code execution as root in the webserver container and can reach the bundled database with default credentials.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DB-GPT","fixed":[],"affected":"<= 0.8.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","db-gpt","docker","pypi","rce","self-hosted","unauthenticated"],"not_affected_if":["default-config"],"how_to_check":"Check whether the DB-GPT version is 0.8.2 or earlier (pip show db-gpt, or the image tag in your Docker setup).\nSend an unauthenticated request to /api/v1/chat/react-agent on your DB-GPT host to see if it answers.","fix":"Upgrade to a DB-GPT release later than 0.8.2 (fixed version not stated in the sources).\nUntil then, block /api/v1/chat/react-agent at the proxy or firewall and change the bundled database default credentials.","status":"open","published_at":"2026-10-20T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:42+00:00","updated_at":"2026-10-23T22:39:42+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-23T22:39:42Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to a DB-GPT release later than 0.8.2 (fixed version not stated in the sources).\nUntil then, block /api/v1/chat/react-agent at the proxy or firewall and change the bundled database default credentials.","reach":"network","title":"DB-GPT: unauthenticated endpoint lets any caller run code as root","impact":"high","summary":"DB-GPT's /api/v1/chat/react-agent endpoint treats every caller as an admin because its user check is a mock, so anyone on the network can send prompts that drive unsandboxed Python and bash tools. An attacker gets code execution as root in the webserver container and can reach the bundled database with default credentials.","category":"ai-tooling","who_cares":["db-gpt","pypi","docker","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs root code in the container and reads the database.","analyst_note":"Confirm the fixed version and whether the react-agent endpoint is enabled by default; check the upstream DB-GPT advisory for a patched release.","how_to_check":"Check whether the DB-GPT version is 0.8.2 or earlier (pip show db-gpt, or the image tag in your Docker setup).\nSend an unauthenticated request to /api/v1/chat/react-agent on your DB-GPT host to see if it answers.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000571,"input_tokens":3028,"output_tokens":537,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD record and the DB-GPT GitHub advisory for the fixed version and whether the react-agent endpoint is reachable by default; sources do not state a patched release or a config check.","search":"'-2026':14A,17A '-77932':15A,18A '/api/v1/chat/react-agent':39B,103C '0.8.2':93C 'admin':46B,119C 'agent':130C 'ai':23B 'ai-tool':22B 'anyon':55B 'arbitrari':140C 'attack':70B,122C 'bash':67B,143C 'bundl':84B,153C 'caller':8A,43B,117C 'check':50B 'code':10A,72B,98C,133C 'contain':79B,94C,149C 'credenti':88B,157C 'cve':13A,16A 'databas':85B,154C 'db':2A,20A,26B,36B,90C 'db-gpt':1A,19A,25B,35B,89C 'default':87B,156C 'docker':28B 'drive':63B 'endpoint':5A,40B,104C 'everi':42B,116C 'execut':73B,99C 'function':113C 'get':71B,109C 'gpt':3A,21A,27B,37B,91C 'grant':115C 'header':112C 'host':33B 'includ':150C 'interpret':134C,137C 'let':6A 'make':127C 'mock':53B,108C 'network':58B 'prompt':61B,125C 'pypi':29B 'python':65B,141C 'rce':30B 'reach':82B,151C 'react':129C 'reli':105C 'remot':97C 'role':120C 'root':12A,75B,145C 'run':9A,139C 'self':32B 'self-host':31B 'send':60B,124C 'shell':136C 'tool':24B,68B,138C 'treat':41B 'unauthent':4A,34B,96C,121C 'unsandbox':64B,132C 'user':49B,110C 'vulner':100C 'webserv':78B,148C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77932","severity":null,"published_at":"2026-10-20T01:17:19+00:00","modified_at":"2026-10-20T14:17:00+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-77932:165","url":null,"severity":null,"published_at":"2026-10-23T22:05:00+00:00","modified_at":"2026-10-23T22:05:00+00:00","first_seen_at":"2026-10-23T22:05:00+00:00","fetched_at":"2026-10-23T22:05:00+00:00","note":"VulnCheck CNA advisory (Lasso Security research) + GHSA: DB-GPT <=0.8.2 affected; no patched release found (latest release v0.8.2, GHSA says patched unknown). No public PoC link or exploitation reports found; X count only CVE feed chatter. Related sibling CVE-2026-77933 (hardcoded MySQL root password, port 3306 exposed in default docker-compose). Lasso advisory page itself not read."}],"documents":[{"id":1304,"url":"https://www.vulncheck.com/advisories/db-gpt-through-0.8.2-unauthenticated-rce-via-api-v1-chat-react-agent","title":"VulnCheck: DB-GPT through 0.8.2 Unauthenticated RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1305,"url":"https://github.com/advisories/GHSA-5vjv-vw3m-qpqp","title":"GHSA-5vjv-vw3m-qpqp (CVE-2026-77932)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1306,"url":"https://github.com/eosphoros-ai/DB-GPT/releases","title":"DB-GPT releases (latest v0.8.2)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1308,"url":"https://www.ionix.io/threat-center/cve-2026-77932/","title":"Ionix: CVE-2026-77932","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}