Is there a patch for CVE-2026-77932 in DB-GPT?

No patched DB-GPT release exists. The OSV record for CVE-2026-77932 lists no fixed version, and the newest tagged release, 0.8.2, sits inside the affected range. Until eosphoros-ai ships a fix, the practical control is network access: keep the DB-GPT web server off untrusted networks and block reachability to the react-agent endpoint.

Which DB-GPT versions are affected by the react-agent flaw?

Every DB-GPT version up to and including 0.8.2 is affected. The OSV record lists the range as introduced at the first commit and last affected at 0.8.2, with commit 83609c4 named as the last affected code. Because that range covers all published releases, upgrading to a newer tag is not an option for DB-GPT operators today.

Does exploiting the DB-GPT flaw need a login or user interaction?

Neither a login nor user interaction is required. The CVSS v4.0 vector VulnCheck published for CVE-2026-77932 records a network attack vector, low complexity, no privileges and no user interaction, scoring 9.3. The mock authentication function grants the admin role to every caller, so anyone able to send an HTTP request to the endpoint reaches the agent's interpreters.

How does the DB-GPT flaw differ from a prompt injection bug?

Prompt injection needs attacker text to reach a model that already holds a trusted session. The DB-GPT flaw skips that step, because the react-agent endpoint never authenticates the caller, so an attacker addresses the ReAct agent directly. The damage then comes from the agent's unsandboxed code_interpreter and shell_interpreter tools, which run Python and bash as root.

HIGHVulnerability

DB-GPT: an unauthenticated request runs shell commands as root

DB-GPT through 0.8.2 accepts unauthenticated prompts that make its ReAct agent run arbitrary code as root.

October 20, 2026 · VulnCheck · Research by Noy Pearl, Michael Sromin, Ophir Dror

CVE-2026-77932

HIGHVulnerability

DB-GPT through 0.8.2 lets anyone who can reach its web server run Python and bash as root, because the react-agent endpoint checks callers with a mock function that grants every request the admin role.

01What happened

VulnCheck published CVE-2026-77932 on 20 October 2026, acting as the CNA for an unauthenticated remote code execution flaw in DB-GPT. DB-GPT is an open-source agentic data assistant from eosphoros-ai that connects language models to databases. The GitHub Advisory Database and OSV carry the same record, and neither lists a fixed version.

02How it works

The /api/v1/chat/react-agent endpoint identifies callers with get_user_from_headers, a mock function that returns the admin role for every request. A caller can therefore send a prompt that drives the ReAct agent's code_interpreter and shell_interpreter tools, neither of which is sandboxed. Those tools run Python and bash as root inside the web server container, and the bundled database is reachable from there with its default credentials.

03Who is affected

Every DB-GPT release up to and including 0.8.2 is listed as affected, with commit 83609c4 recorded as the last affected code. Exposure depends on who can reach the web server: no account, token or user action is needed, so any network path to the endpoint is enough.

04What to do

No patched DB-GPT release exists, so block network access to the web server and to /api/v1/chat/react-agent until one ships. Replace the bundled database's default credentials, and review access logs on any instance that untrusted networks could reach.

Questions people ask

Is there a patch for CVE-2026-77932 in DB-GPT?: No patched DB-GPT release exists. The OSV record for CVE-2026-77932 lists no fixed version, and the newest tagged release, 0.8.2, sits inside the affected range. Until eosphoros-ai ships a fix, the practical control is network access: keep the DB-GPT web server off untrusted networks and block reachability to the react-agent endpoint.
Which DB-GPT versions are affected by the react-agent flaw?: Every DB-GPT version up to and including 0.8.2 is affected. The OSV record lists the range as introduced at the first commit and last affected at 0.8.2, with commit 83609c4 named as the last affected code. Because that range covers all published releases, upgrading to a newer tag is not an option for DB-GPT operators today.
Does exploiting the DB-GPT flaw need a login or user interaction?: Neither a login nor user interaction is required. The CVSS v4.0 vector VulnCheck published for CVE-2026-77932 records a network attack vector, low complexity, no privileges and no user interaction, scoring 9.3. The mock authentication function grants the admin role to every caller, so anyone able to send an HTTP request to the endpoint reaches the agent's interpreters.
How does the DB-GPT flaw differ from a prompt injection bug?: Prompt injection needs attacker text to reach a model that already holds a trusted session. The DB-GPT flaw skips that step, because the react-agent endpoint never authenticates the caller, so an attacker addresses the ReAct agent directly. The damage then comes from the agent's unsandboxed code_interpreter and shell_interpreter tools, which run Python and bash as root.

Sources 3 links, all fetched

1vulncheck.comVulnCheck Advisory
2github.comGitHub Advisory
3osv.devOSV Record