Live › vulnerability › CVE-2026-77933
Go to dashboardDB-GPT, an AI database assistant, ships a default docker-compose.yml with a fixed MySQL root password and port 3306 open on all interfaces. An attacker who reaches that port can log in as root and gain full database access, including FILE and SUPER privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
MYSQL_ROOT_PASSWORD\|3306 docker-compose.yml
If the password is the hardcoded default and the ports line publishes 3306 without a host IP, you are exposed{{.Names}} {{.Ports}} | grep 33060.8.2 once a fixed release is confirmed; the sources do not name one127.0.0.1, and set MYSQL_ROOT_PASSWORD to a unique secretEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-77933")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.