DB-GPT: Code execution on host via silent fallback to LocalRuntime
Summary
In DB-GPT v0.8.0, the sandbox service can silently use LocalRuntime, which runs submitted code directly on the host instead of in a container. The fallback applies when no container runtime (Docker, Podman or Nerdctl) is available, and the default setting SANDBOX_RUNTIME=local also selects it. An attacker who can reach the sandbox HTTP API, or who can get the AI agent to generate code through the Web UI, may run arbitrary commands with the privileges of the DB-GPT process. Secondary reports describe this as requiring no authentication, which the vendor has not confirmed.
Affected
- DB-GPT v0.8.0 (per CVE description)
- Other versions: Unknown.
Fixed in
Unknown. No fixed version has been confirmed by the vendor.
Workaround
- Ensure a supported container runtime (Docker, Podman or Nerdctl) is available and explicitly configured, so that code runs in a container.
- Do not rely on the default SANDBOX_RUNTIME setting; verify the effective runtime on each instance.
- Restrict network access to DB-GPT and its sandbox API, for example behind a VPN or authentication.
- Restrict host access and outbound connections of the DB-GPT service.
Exploitation
- CISA SSVC: Exploitation 'poc', automatable: yes, technical impact: total.
- A proof-of-concept is referenced in GitHub issue #3082; other sources state that no public exploit code has been confirmed. Reports conflict.
- Not listed in CISA KEV. No in-the-wild exploitation known.
Our recommendation
- Check whether DB-GPT is in use, which version is deployed, and whether it is reachable from untrusted networks.
- Isolate affected instances until the vendor confirms a fixed version.
- Treat 0.8.0 installations that were reachable from untrusted networks as potentially compromised and review logs and host files.
- Do not assume that version 0.8.2 is fixed; check the vendor advisories and issue #3082 for updates.
- Monitor the vendor and NVD for an advisory and apply the fix as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51869 research gist (Ro1ME) gist.github.com
- DB-GPT GitHub issue #3082 github.com
- VulDB: CVE-2026-51869 vuldb.com
- HOL Guard: CVE-2026-51869 (CISA ADP) hol.org
- DB-GPT pull request #3272 (sandbox change) github.com
- DB-GPT releases github.com
- DB-GPT GitHub issue #3321 github.com
- DB-GPT GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:43.
Original description (NVD)
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.