Is CVE-2026-77932 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-77932?

CVE-2026-77932 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-77932

Description

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.