DB-GPT: Unauthenticated remote code execution via ReAct agent endpoint
Summary
DB-GPT through 0.8.2 contains an authentication bypass in the /api/v1/chat/react-agent endpoint. A mock user function grants every caller the admin role, so unauthenticated attackers can send prompts that make the agent run arbitrary Python or bash commands as root in the webserver container. The bundled database can also be reached with default credentials, which may expose data and enable further attacks on the network.
Affected
- eosphoros-ai DB-GPT versions 0.8.2 and earlier (according to the CVE record, 0 to <= 0.8.2)
- Lasso reports a tested vulnerable version 0.8.1
- Default deployments listen on 0.0.0.0:5670 (all interfaces), according to a GitHub report
Fixed in
Unknown. No vendor advisory or patched release was found. Do not assume that 0.8.2 or later releases are safe.
Workaround
- Take exposed DB-GPT instances off the network or place them behind real authentication (reverse proxy with authentication, VPN, firewall)
- Do not rely on the mock authentication
- Block external access to the webserver port and to database port 3306
- Rotate default database credentials
- Disable the ReAct agent endpoint if it is not needed (no vendor-confirmed switch known)
Exploitation
- No authentication required; attack works over the network
- CISA SSVC: exploitation status 'poc', automatable 'yes', technical impact 'total'
- Lasso publishes a detailed exploitation chain; a GitHub issue reports an unauthenticated request on v0.8.1 that triggered the agent
- No evidence of in-the-wild exploitation found; not listed in CISA KEV
Our recommendation
- Check your inventory for DB-GPT, including Docker images, pip installations and forgotten test instances
- Immediately remove internet exposure of any DB-GPT instance up to version 0.8.2
- Restrict access at network level and rotate database credentials
- Monitor the webserver container for unexpected shell or Python activity
- Check the vendor repository for a fixed release and update as soon as one is confirmed
- Note: CVSS scores differ between sources (9.3 in NVD record, 9.8 in some others)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-77932 Lasso Security www.lasso.security
- VulnCheck advisory www.vulncheck.com
- DB-GPT code_interpreter.py at commit 83609c4 github.com
- DB-GPT auth.py at commit 83609c4 github.com
- DB-GPT GitHub issue #3289 github.com
- Strix CVE-2026-77932 www.strix.ai
- VulDB CVE-2026-77932 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:11.
Original description (NVD)
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.
NVD references (4)
- https://github.com/eosphoros-ai/DB-GPT/blob/83609c471266607490b24e72188311efa23a0d16/packages/dbgpt-app/src/d…
- https://github.com/eosphoros-ai/DB-GPT/blob/83609c471266607490b24e72188311efa23a0d16/packages/dbgpt-serve/src…
- https://www.lasso.security/vulnerability-database/cve-2026-77932
- https://www.vulncheck.com/advisories/db-gpt-through-0.8.2-unauthenticated-rce-via-api-v1-chat-react-agent
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.