Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77933— DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment

Quick assessment

Affected
eosphoros-ai DB-GPT
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DB-GPT 0.8.2 及更早版本存在硬编码凭据漏洞：其默认的 docker-compose.yml 文件配置了静态的 MYSQL_ROOT_PASSWORD，并将 3306 端口开放至所有网络接口。攻击者若能访问 3306 端口或进入共享的 dbgptnet 网络，即可使用 root@% 凭据进行认证，从而获得数据库的完全访问权限，包括 FILE 和 SUPER 特权。

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77933

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
Source: CVE Program / CVE List V5
Vulnerability Description
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1392
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
eosphoros-ai DB-GPT 0 ~ 0.8.2 -

II. Public POCs for CVE-2026-77933

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77933

请登录查看更多情报信息。

Other References for CVE-2026-77933 (3)

IV. Related Vulnerabilities

Same product: DB-GPT
Same vendor: eosphoros-ai
Same weakness: CWE-1392

V. Comments for CVE-2026-77933

No comments yet

Leave a comment