CVE-2026-3409Disclosure

LOWCVSS 5.5 · MEDIUM

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/awel/flow/import of the component Flow Import Endpoint. Performing a manipulation as part of File results in code injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-74CWE-94

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
6 mentions across 4 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 3d ago at 3 mentions (2026-03-02); latest day: 1
6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Disclosure

466.7%

Active Exploitation

116.7%

General

116.7%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	3	Active Exploitation1Disclosure2
2026-03-05	1	General1
2026-03-06	1	Disclosure1
2026-03-07	1	Disclosure1

Full discourse6 posts

CRAC Learning - Tech@cracbot215d
Disclosure
CVE-2026-3409 (CVSS:6.9, HIGH) is Awaiting Analysis. A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFil..https://nvd.nist.gov/vuln/detail/CVE-2026-3409 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The tweet announces the existence of CVE-2026-3409, a high‑severity flaw in eosphoros‑ai db‑gpt 0.7.5 affecting importlib.machinery.SourceFil, but provides no exploitation or remediation details.
0000023
173 followersView on X
CRAC Learning - Tech@cracbot216d
Disclosure
CVE-2026-3409 (CVSS:6.9, HIGH) is Awaiting Analysis. A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFil..https://nvd.nist.gov/vuln/detail/CVE-2026-3409 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
A new CVE-2026-3409 vulnerability in eosphoros-ai db-gpt 0.7.5 affecting importlib.machinery.SourceFile with CVSS 6.9 (HIGH) has been publicly disclosed and is awaiting analysis.
0000023
173 followersView on X
CRAC Learning - Tech@cracbot217d
General
CVE-2026-3409 (CVSS:6.9, HIGH) is Awaiting Analysis. A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFil..https://nvd.nist.gov/vuln/detail/CVE-2026-3409 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE‑2026‑3409 with basic technical details and no evidence of exploits, PoC, or patches; it is a straightforward disclosure.
0000020
173 followersView on X
Infoflowcloud@infoflowcloud221d
Disclosure
🚨*CVE* CVE-2026-3409 A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/aw… https://www.cve.org/CVERecord?id=CVE-2026-3409 ----- Traducción: CVE-2026-3409 Se … http://infoflow.cloud`
Post summary
A new CVE-2026-3409 vulnerability in eosphoros-ai db-gpt 0.7.5 affecting importlib.machinery.SourceFileLoader.exec_module has been disclosed, with no PoC, exploit, or patch details provided.
0000039
55 followersView on X
CVE@CVEnew221d
Disclosure
CVE-2026-3409 A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/aw… https://www.cve.org/CVERecord?id=CVE-2026-3409
Post summary
A vulnerability was identified in eosphoros‑ai db‑gpt 0.7.5 affecting importlib.machinery.SourceFileLoader.exec_module, but no exploitation or patch details are provided.
00000330
56.6K followersView on X
VulDB 🛡@vuldb221d
Active Exploitation
Some increased actor activities are shown targeting eosphoros-ai db-gpt (CVE-2026-3409) https://vuldb.com/?ctiid.348304
Post summary
The post indicates that actors are increasingly targeting CVE-2026-3409, suggesting potential active exploitation, but no specific exploit code or patch details are provided.
0000076
2.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-3409

CRAC Learning - Tech@cracbotDisclosure

The tweet announces the existence of CVE-2026-3409, a high‑severity flaw in eosphoros‑ai db‑gpt 0.7.5 affecting importlib.machinery.SourceFil, but provides no exploitation or remediation details.

CRAC Learning - Tech@cracbotDisclosure

A new CVE-2026-3409 vulnerability in eosphoros-ai db-gpt 0.7.5 affecting importlib.machinery.SourceFile with CVSS 6.9 (HIGH) has been publicly disclosed and is awaiting analysis.

CRAC Learning - Tech@cracbotGeneral

The post announces CVE‑2026‑3409 with basic technical details and no evidence of exploits, PoC, or patches; it is a straightforward disclosure.

Infoflowcloud@infoflowcloudDisclosure

A new CVE-2026-3409 vulnerability in eosphoros-ai db-gpt 0.7.5 affecting importlib.machinery.SourceFileLoader.exec_module has been disclosed, with no PoC, exploit, or patch details provided.

CVE@CVEnewDisclosure

A vulnerability was identified in eosphoros‑ai db‑gpt 0.7.5 affecting importlib.machinery.SourceFileLoader.exec_module, but no exploitation or patch details are provided.

VulDB 🛡@vuldbActive Exploitation

The post indicates that actors are increasingly targeting CVE-2026-3409, suggesting potential active exploitation, but no specific exploit code or patch details are provided.