---
id: "CVE-2026-77932"
kind: "vulnerability"
aliases: ["CVE-2026-77932"]
title: "DB-GPT: unauthenticated endpoint lets any caller run code as root"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "DB-GPT", "fixed": [], "affected": "<= 0.8.2", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "db-gpt", "docker", "pypi", "rce", "self-hosted", "unauthenticated"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T01:17:19+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:39:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77932", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:05:00+00:00"}]
---

# DB-GPT: unauthenticated endpoint lets any caller run code as root

DB-GPT's /api/v1/chat/react-agent endpoint treats every caller as an admin because its user check is a mock, so anyone on the network can send prompts that drive unsandboxed Python and bash tools. An attacker gets code execution as root in the webserver container and can reach the bundled database with default credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:DB-GPT affected <= 0.8.2 fixed ?

## How to check

Check whether the DB-GPT version is 0.8.2 or earlier (pip show db-gpt, or the image tag in your Docker setup).
Send an unauthenticated request to /api/v1/chat/react-agent on your DB-GPT host to see if it answers.

## Fix

Upgrade to a DB-GPT release later than 0.8.2 (fixed version not stated in the sources).
Until then, block /api/v1/chat/react-agent at the proxy or firewall and change the bundled database default credentials.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77932
- 2026-10-23T22:05:00+00:00 analyst — VulnCheck CNA advisory (Lasso Security research) + GHSA: DB-GPT <=0.8.2 affected; no patched release found (latest release v0.8.2, GHSA says patched unknown). No public PoC link or exploitation reports found; X count only CVE feed chatter. Related sibling CVE-2026-77933 (hardcoded MySQL root password, port 3306 exposed in default docker-compose). Lasso advisory page itself not read.

## Documents

- [advisory] VulnCheck: DB-GPT through 0.8.2 Unauthenticated RCE https://www.vulncheck.com/advisories/db-gpt-through-0.8.2-unauthenticated-rce-via-api-v1-chat-react-agent
- [advisory] GHSA-5vjv-vw3m-qpqp (CVE-2026-77932) https://github.com/advisories/GHSA-5vjv-vw3m-qpqp
- [describes] Ionix: CVE-2026-77932 https://www.ionix.io/threat-center/cve-2026-77932/
- [mentions] DB-GPT releases (latest v0.8.2) https://github.com/eosphoros-ai/DB-GPT/releases

## From the sources

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_