CVE-2026-77933

LOWCVSS 9.3 · CRITICAL

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1392

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

Harsha Hegde@HarshaHegde021h
All 13 👇 DB-GPT: CVE-2026-77932 (9.8), CVE-2026-77933 (9.8) Letta: CVE-2026-77936 (9.8), CVE-2026-77937 Langchain-Chatchat: CVE-2026-75128 (9.8) piflow: CVE-2026-109442 (9.8) Coze Studio: CVE-2026-77934, CVE-2026-77935 Aix-DB: CVE-2026-77926 OpenSRE: CVE-2026-109444 JoySafeter: CVE-2026-109443 EvoScientist: CVE-2026-77930 LangAlpha: CVE-2026-109440 only coze studio has a fix so far (0.5.0) Full breakdown: https://severitydaily.com/ai-agent-frameworks-thirteen-records-vulncheck-lasso-cwe-306-cwe-1188-shipped-defaults-no-fixed-version/
0000056
14 followersView on X

Explore more

Back to dashboard