CVE-2026-47668

CVE-2026-47668 — DbGate Remote Code Execution Unauthenticated RCE in DbGate JSON Script Runner dbgate-serve ≤ 7.1.8. Assessment tool: CVE-2026-47668.py — authorized testing only. | ---|--- CVE| CVE-2026-47668 Severity| Critical Product| DbGate / dbgate-serve Affected| ≤ 7.1.8 Fixed| ≥ 7.1.9 CVSS...

DbGate - Remote Code Execution via Dynamic Import Bypass

DbGate versions = 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import. id:...

DbGate - Remote Code Execution via Anonymous JWT

DbGate contains a remote code execution vulnerability exploitable by unauthenticated attackers. The /auth/login endpoint issues anonymous JWT tokens without credentials, and the /runners/start endpoint accepts JavaScript payloads that execute via Node.js childprocess, allowing arbitrary command...

CVE-2026-47670

CVE-2026-47670 Authenticated Remote Code Execution via loadReader functionName code injection in DbGate DbGate is an open-source, cross-platform database management tool designed for developers and database administrators who need to work with multiple database systems simultaneously. It provides...

CVE-2026-47668

CVE-2026-47668 Unauthenticated RCE in DBGate = 7.1.8 REF1: https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc REF2: https://github.com/Nxploited/CVE-2026-47668 rce.py Minimal implementation of RCE on /runners/start, Privileged If process can write to ./public/ folder, file...

GHSA-474X-HRWR-FGX4 vulnerabilities

Vulnerabilities for packages: dbgate-fips, supabase, opensearch-dashboards-fips, jitsucom-jitsu, supabase-fips, cypress, prism, langfuse-fips, kibana, dbgate, thingsboard-fips, opensearch-dashboards, dotstatsuite-supercore, homepage, nextcloud-server, supabase-storage-api-fips, lambda-nodejs,...

CVE-2026-126066 vulnerabilities

Vulnerabilities for packages: dbgate-fips, supabase, opensearch-dashboards-fips, jitsucom-jitsu, supabase-fips, cypress, prism, langfuse-fips, kibana, dbgate, thingsboard-fips, opensearch-dashboards, dotstatsuite-supercore, homepage, nextcloud-server, supabase-storage-api-fips, lambda-nodejs,...

CVE-2026-48017

CVE-2026-48017 — Remote Code Execution in DbGate via functionName injection Severity : High CVSS 8.8 CWE : CWE-94 — Improper Control of Generation of Code 'Code Injection' Affected : dbgate-api ≤ 7.1.8 patched in 7.1.9 Advisory : GHSA-hv83-ggc4-v385 NVD :...

VulnCheck KEV: CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

CVE-2026-121455

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test and save never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe...

CVE-2026-121455 DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test and save never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe...

CVE-2026-121455

DbGate versions prior to 7.3.3 are vulnerable to a missing authorization flaw in the test() and save() functions. The root cause is that these functions fail to call testConnectionPermission , allowing authenticated users with connection restrictions to bypass LOGIN_PERMISSIONS . An attacker can ...

CVE-2026-121455 DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test and save never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe...

EUVD-2026-115887

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test and save never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe...

CVE-2026-121455 DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test and save never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe...

CVE-2026-121455: dbgate: DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated…

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test and save never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe...

VulnCheck KEV: CVE-2026-47670

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

CVE-2026-109461 vulnerabilities

Vulnerabilities for packages: dbgate-fips, librechat, dbgate, saf, redisinsight, azurite...

GHSA-XCX6-JX8P-X3H5 vulnerabilities

Vulnerabilities for packages: dbgate-fips, librechat, dbgate, saf, redisinsight, azurite...

CVE-2026-101070

A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be...