DB-GPT vulnerabilities
CVEs whose affected-version data names the DB-GPT package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-77933Critical· 9.8DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet n…
▾ Midnighteosphoros-ai · DB-GPTvia CVEORG
CVE-2026-77932Critical· 9.8DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated a…
▾ Midnighteosphoros-ai · DB-GPTvia CVEORG