External risk intelligence

DB-GPT Unauthenticated Remote Code Execution via React-Agent API

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-77932

The vulnerability exists in an API endpoint (/api/v1/chat/react-agent) of a web application. Web applications and their APIs are commonly deployed as internet-facing services to facilitate user interaction, making this reachable surface a typical part of the application's design and deployment model.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in DB-GPT allows unauthenticated attackers to execute arbitrary code as the root user by sending specially crafted prompts. This could potentially grant attackers access to the bundled database and other system resources within the affected container.

Attackers can run code remotely without authentication.
High severity exposure to core systems and data.
Confirm relevance and assess potential impact to our systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can reach the application's API and send a specially crafted prompt to the `/api/v1/chat/react-agent` endpoint. This endpoint incorrectly grants administrative privileges due to a flawed authentication mechanism, allowing the attacker to execute arbitrary code on the server via the ReAct agent's tools.

No authentication required.
Triggered by API request with a malicious prompt.
Leads to remote code execution as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code with root privileges within the web server container. This exposure could grant access to the bundled database using default credentials, potentially affecting system data and service behavior.

System data could be accessed or modified.
Unauthenticated network requests could trigger execution.
Compromised container and database access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners, likely supported by infrastructure and security teams, are responsible for addressing this unauthenticated remote code execution vulnerability. The immediate practical move is to inventory all instances of the affected technology, determine their exposure and criticality, and then assign ownership for remediation planning.

Assign platform or application owners.
Verify external reachability and business impact.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DB-GPT?

DB-GPT is an open-source framework designed to help developers build database-centric applications powered by large language models. It provides tools to interact with databases using natural language and features a ReAct agent, which allows the system to perform complex tasks by executing code or shell commands to process data or perform actions on behalf of the user.

How does CVE-2026-77932 enable code execution?

This vulnerability is classified as CWE-306, which relates to a lack of authentication for a critical function. In this case, the application's API incorrectly assumes that any request to the ReAct agent is authorized. This flaw bypasses security checks, allowing the agent to run unauthorized Python scripts or shell commands on the underlying server with root privileges.

What triggers this vulnerability in the React-Agent API?

An attacker can trigger this issue by sending a specially crafted prompt to the specific `/api/v1/chat/react-agent` endpoint. Because the system fails to verify the identity of the person making the request, it treats the input as trusted. The bug is not triggered by standard usage or legitimate prompts, but rather by the malicious interaction that commands the agent to execute arbitrary system code.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a significant concern because the affected component is a web application API. Since these services are frequently deployed as internet-facing components to support user interaction, they are highly reachable. If your instance is exposed to the internet, it is more likely to be accessible to external attackers compared to services restricted to internal networks.

What should I do first to manage this risk?

Begin by creating an inventory of all instances of DB-GPT running within your environment to identify which versions are in use. Once you have a list, determine which of these services are accessible over the network and assess their business criticality. After confirming the footprint, work with your engineering teams to prioritize remediation planning and monitor for official updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.