4 matches found
CVE-2026-77932
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...
CVE-2026-77932
DB-GPT versions through 0.8.2 are vulnerable to an unauthenticated remote code execution (RCE) vulnerability. The flaw exists because the /api/v1/chat/react-agent endpoint utilizes a mock get_user_from_headers function that incorrectly assigns every caller the admin role . Attackers can exploit t...
CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...
EUVD-2026-104688
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...