Unauthenticated Remote Code Execution in DB-GPT by Eosphoros AI
CVE-2026-77932

9.3CRITICAL

Key Information:

Vendor: Eosphoros-ai
Status: Db-gpt
Vendor: CVE Published:; 20 October 2026

🔔 Create Eosphoros-ai Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-77932?

DB-GPT versions up to 0.8.2 are susceptible to an unauthenticated remote code execution vulnerability, allowing unauthorized attackers to exploit the /api/v1/chat/react-agent endpoint. This exploitation results from a flaw in the mock get_user_from_headers function, which erroneously assigns admin roles to all callers. As a consequence, attackers can send harmful requests that trigger the execution of unsandboxed code_interpreter and shell_interpreter tools, enabling them to run arbitrary Python or Bash commands in the web server environment. This issue poses a serious threat, potentially allowing unauthorized access to the integrated database using default credentials.

Affected Version(s)

DB-GPT 0 <= 0.8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-77932 - Proof of Concept