CVE-2026-77933

9.8Critical

Published 20 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-1392

Impact

Unauthenticated network attackers can gain full root administrative access to the underlying MySQL database, including FILE and SUPER privileges. All they need is network access to port 3306 or the shared dbgptnet Docker network.

Root cause

The default docker-compose.yml defines a static, hardcoded MYSQL_ROOT_PASSWORD and exposes port 3306 on all host interfaces.

Affected systems

DB-GPT through 0.8.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Fixed version not specified; update docker-compose.yml to remove the public port binding for 3306 and set a strong, unique MYSQL_ROOT_PASSWORD in your environment file before restarting containers.

shell

$ docker compose down && sed -i 's/- "3306:3306"/# - "3306:3306"/' docker-compose.yml && docker compose up -d

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-77933