CVE-2026-77933
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default…
- Risk score
- 79/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- DB-GPT contains a hardcoded credentials vulnerability in its default docker-compose.yml, allowing attackers to gain full database access, including FILE and SUPER privileges, by authenticating as root@%. This is remotely exploitable without logging in.
- Affected
- {'products': ['DB-GPT'], 'packages': [], 'versions': ['0.8.2']}
- Fix
- Check the linked advisory for a fix, but as a minimum, do not use the default docker-compose.yml and ensure you do not expose port 3306 to the internet.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
- On your watchlist: docker
References
Original description
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
Last activity 20 Oct 2026. Patch Forecast updates every hour.