Unauthenticated RCE in DB-GPT via Insecure Mock Authentication

DB-GPT versions through 0.8.2 are vulnerable to an unauthenticated remote code execution (RCE) flaw originating from an insecure implementation of the get_user_from_headers function. This function serves as a mock authentication mechanism, incorrectly assigning the "admin" role to every incoming request regardless of provided headers.

The vulnerability is exposed via the /api/v1/chat/react-agent endpoint. Attackers can leverage this misconfiguration to interact with the ReAct agent, specifically utilizing the code_interpreter and shell_interpreter tools. Because these tools operate in an unsandboxed environment within the webserver container, they permit the execution of arbitrary Python or bash commands with root-level privileges. An attacker successful in exploiting this vulnerability can gain full control over the container, access sensitive application data, or interact with the bundled database using default administrative credentials.

Impact

Successful exploitation results in full remote code execution within the DB-GPT webserver container. Attackers can achieve complete system compromise, exfiltrate data from the bundled database, or move laterally if the container lacks sufficient network segmentation. This vulnerability is particularly critical for deployments exposed to untrusted networks.

Recommendation

• Immediately upgrade to a patched version of DB-GPT that addresses CVE-2026-77932 and removes the mock get_user_from_headers function.
• Restrict network access to the /api/v1/chat/react-agent endpoint to authorized internal segments only using a Web Application Firewall (WAF) or ingress controller rules.
• Audit logs for suspicious HTTP POST requests directed at /api/v1/chat/react-agent containing shell metacharacters or unauthorized Python code patterns.
• Implement strict resource limits and user privilege isolation for the DB-GPT container to minimize the impact of a potential container breakout or compromise.