Is CVE-2026-77933 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-77933?

CVE-2026-77933 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-77933

Description

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.