CVE-2026-77933

CRITICAL

Summary

generated automatically from NVD data

DB-GPT through version 0.8.2 ships a default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and exposes MySQL port 3306 on all network interfaces (CWE-1392, use of default credentials). An attacker who can reach port 3306 or the shared dbgptnet network can log in as root@% and obtain full database access, including the FILE and SUPER privileges. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.

NVD description

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

Self-Hosted AI Agents: 6 CVEs at 9.8 in Letta, DB-GPT, Langchain-Chatchat, piflow and Cognition

CVSS v3.1 Score

9.8

/ 10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Information

Published: 20 oct. 2026
Updated: 20 oct. 2026
Status: Deferred
Source: disclosure@vulncheck.com

Weaknesses (CWE)

CWE-1392

References (3)

Similar CVEs

Other vulnerabilities of type CWE-1392

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring