External risk intelligence

DbGate Remote Code Execution via JSON Script Runner.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-47668

DbGate is a database management tool that provides an HTTP-based script runner interface. Because this component exposes web-based functionality that handles remote requests, it is commonly deployed as an accessible service or web-based utility, making it likely to be reachable in environments where such management interfaces are exposed to the network.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the DbGate database management tool could allow an unauthenticated attacker to execute arbitrary code on affected systems. This occurs when the tool processes specific script commands, potentially leading to a compromise of the underlying server.

Remote code execution in database management tool.
Executive concern is understanding if this tool is in use.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can remotely execute code on a DbGate server by sending a specially crafted request to the JSON script runner. This request exploits a vulnerability where user-supplied input in the `functionName` parameter is directly embedded into JavaScript code that is then executed by the server. This could lead to a complete compromise of the affected system.

No authentication required for access.
Inject code via the `functionName` parameter.
Remote code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, DbGate's JSON script runner could allow remote code execution through code injection in the `functionName` parameter. This occurs when the `functionName` value is directly inserted into JavaScript code, which is then executed by a Node.js child process.

Remote code execution.
Via code injection in `functionName`.
Compromise of the affected system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects DbGate's JSON script runner, enabling remote code execution. Application owners or platform teams managing DbGate instances are likely responsible for addressing this. The initial step involves identifying all deployed DbGate instances, confirming their network reachability, and assessing their criticality to prioritize remediation efforts.

Application or platform teams own remediation.
Verify remote reachability and business impact.
Coordinate planned upgrades or vendor patches.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DbGate?

DbGate is a cross-platform database management tool that provides a unified interface for working with various database systems. It includes an HTTP-based script runner component that allows users to execute automated tasks. Because it serves as a central hub for database administration, it is often deployed in environments where administrators need to connect to and manage multiple data sources from a single application.

How does CVE-2026-47668 work?

This vulnerability is a code injection flaw, classified under CWE-94. It occurs because the application takes input from the 'functionName' parameter and inserts it directly into JavaScript code using string concatenation. Since the application fails to sanitize this input, an attacker can provide malicious commands that the server then executes as part of its internal script, leading to arbitrary code execution within a Node.js child process.

What triggers this vulnerability?

An attacker triggers the flaw by sending a crafted JSON request to the /runners/start endpoint. The vulnerability relies on the application accepting unauthenticated requests to this specific runner interface. It is important to note that simply running the DbGate application does not trigger the bug; the system must be reachable and configured to process these specific script runner requests for the malicious injection to occur.

Do I need to worry about this if my DbGate instance is internal?

Halo Surface Signal indicates that DbGate is often deployed as a web-accessible utility, making it a common target when these management interfaces are exposed to the network. While an internal instance may have a smaller attack surface, any network-reachable installation is susceptible. You should confirm if your deployment is accessible beyond trusted segments, as the lack of authentication makes this a high-priority risk for any reachable system.

What steps should I take to address this?

First, identify all instances of DbGate running in your environment. Check the version of each deployment to determine if it is 7.1.8 or older, which are the affected versions. If you find vulnerable versions, coordinate with your team to update to version 7.1.9, which contains the necessary patch to prevent input from being incorrectly executed as code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.