Hardcoded Credentials Vulnerability in DB-GPT by Eosphoros AI
CVE-2026-77933

9.3CRITICAL

Key Information:

Vendor

Eosphoros-ai

Status
Db-gpt
Vendor
CVE Published:
20 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-77933?

DB-GPT versions up to 0.8.2 have a severe vulnerability due to hardcoded credentials within its default docker-compose.yml configuration. This includes a static MYSQL_ROOT_PASSWORD and exposes port 3306 on all interfaces, allowing unauthorized access. Attackers capable of accessing port 3306 or connecting to the shared dbgptnet network can exploit this flaw by authenticating as root@%, granting them unrestricted access to the database, including high-level privileges such as FILE and SUPER privileges. Users of DB-GPT are strongly advised to review their configurations and take necessary actions to mitigate the risk of unauthorized database access.

Affected Version(s)

DB-GPT 0 <= 0.8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-77933 - Proof of Concept

References

https://www.lasso.security/vulnerability-database/cve-202...
technical-descriptionexploit
https://github.com/eosphoros-ai/DB-GPT/blob/83609c4712666...
technical-description
https://www.vulncheck.com/advisories/db-gpt-through-0.8.2...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Noy Pearl
Michael Sromin
Ophir Dror
.