{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/aix-db/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aix-db:aix-db:1.2.4:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-77926"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Aix-DB (1.2.4)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["Aix-DB"],"content_html":"\u003cp\u003eAix-DB version 1.2.4 contains a critical remote code execution (RCE) vulnerability identified as CVE-2026-77926. The vulnerability exists within the ChatBI common agent, specifically due to an ungated tool known as 'deepagents execute'. This flaw allows authenticated non-admin users to manipulate the agent's input, resulting in the execution of arbitrary operating system commands on the underlying host. The impact of this vulnerability is significant, as successful exploitation provides attackers with the ability to exfiltrate sensitive data, including datasource credentials and model API keys, potentially leading to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-77926 allows attackers to bypass intended access controls, executing OS-level commands with the privileges of the Aix-DB application. This facilitates the theft of stored credentials, API keys, and internal system configurations, posing a high risk to organizations utilizing this software.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately restrict access to the '/dify/get_answer' endpoint at the web application firewall (WAF) or load balancer level for unauthorized users.\u003c/li\u003e\n\u003cli\u003eAudit application logs for abnormal command patterns originating from the ChatBI agent.\u003c/li\u003e\n\u003cli\u003ePatch Aix-DB to the latest version once a security update is released by the vendor.\u003c/li\u003e\n\u003cli\u003ePerform a credential rotation for all datasource secrets and model API keys if unauthorized access is suspected.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T02:32:07Z","date_published":"2026-10-20T02:32:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aix-db-rce/","summary":"Authenticated non-admin users can execute arbitrary system commands in Aix-DB version 1.2.4 by exploiting an unvalidated execute tool within the ChatBI agent via crafted HTTP requests.","title":"Remote Code Execution in Aix-DB ChatBI Agent","url":"https://feed.craftedsignal.io/briefs/2026-10-aix-db-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Aix-DB","version":"https://jsonfeed.org/version/1.1"}