DB-GPT Mock Function Bug Enables Unauthenticated Root Code Execution in Containers

DB-GPT versions through 0.8.2 contain a critical unauthenticated remote code execution flaw that allows attackers to run arbitrary code as root. The vulnerability exists in the /api/v1/chat/react-agent endpoint, which relies on a mock function that assigns the admin role to every caller without verifying identity.

What happened

The vulnerability, identified as CVE-2026-77932, carries a CVSS score of 9.3, which is rated as critical. According to the National Vulnerability Database, the issue is caused by the /api/v1/chat/react-agent endpoint using a mock get_user_from_headers function. This function incorrectly grants the admin role to every caller, regardless of authentication status.

Attackers can exploit this by sending prompts to the endpoint. These prompts trigger the ReAct agent’s unsandboxed code_interpreter and shell_interpreter tools. Because the caller is treated as an admin, these tools execute arbitrary Python or bash commands as root within the webserver container. This access extends to the bundled database, which uses default credentials.

The flaw is classified under CWE-306, which covers incorrect default permissions. It affects all versions of eosphoros-ai DB-GPT up to and including 0.8.2. The vulnerability allows full control over the webserver and database without any initial authentication or valid user credentials.

Why it matters

Security operations teams must recognize that unauthenticated access to administrative functions creates immediate risk. In this case, the mock function bypasses standard identity checks entirely. This means any network path to the endpoint is a potential attack vector. The ability to run code as root inside a container is particularly dangerous because it allows attackers to pivot to other systems or exfiltrate data stored in the bundled database.

The use of default credentials in the bundled database further amplifies the impact. Once an attacker executes code as root, they can access these credentials easily. This combination of unauthenticated access and privileged execution means that the integrity of the entire host environment is at stake. Teams deploying DB-GPT in production environments are exposed to this specific configuration error.

Our take on the response

• Isolate affected DB-GPT instances from untrusted networks immediately
• Audit logs for unauthorized access to the /api/v1/chat/react-agent endpoint
• Verify that no external users have accessed the bundled database
• Monitor for unusual Python or bash process execution within containers

What defenders should look for

Teams usually detect this type of activity by monitoring for unauthorized administrative actions on API endpoints. Check whether the /api/v1/chat/react-agent endpoint receives requests from unauthenticated sources. Look for sudden spikes in process creation within containers, especially for Python or bash interpreters. Monitor for outbound connections from the webserver container to unexpected destinations. Verify that no new users or credentials have been added to the bundled database. Review container logs for signs of privilege escalation or root-level command execution. Investigate any anomalies in API access patterns that deviate from normal user behavior.

Background: Unauthorized access

Most teams assume unauthorized access means broken encryption or stolen passwords. In reality, attackers often use valid accounts, legitimate tools, and internal trust relationships. Detection fails because alerts are tuned to look for outsiders, not insiders acting strangely.

Read the full guide: Unauthorized Access Myths: What Detection Actually Misses

What to do and how to stay safe: DB-GPT

• Restrict network access to the DB-GPT endpoint to trusted internal IPs only
• Monitor container logs for unexpected execution of Python or bash scripts
• Change default credentials for any bundled databases immediately
• Once the vendor provides an update, apply it to all affected instances

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-77932?

The CVSS score for CVE-2026-77932 is 9.3, which is rated as critical.

Which DB-GPT versions are affected by this vulnerability?

All versions of DB-GPT up to and including 0.8.2 are affected.

How do attackers exploit this vulnerability?

Attackers send prompts to the /api/v1/chat/react-agent endpoint to execute arbitrary code as root.