DB-GPT through version 0.8.2 ships a default Docker Compose configuration with a static MySQL root password and port 3306 published on all interfaces. If an operator deploys with those defaults unchanged and the port is reachable, an unauthenticated network attacker can log in as root and take full control of the database.
What Is It
CVE-2026-77933 is classified under CWE-1392 (Use of Default Credentials) and affects the default docker-compose.yml of eosphoros-ai's DB-GPT. The advisory title calls these "hardcoded" MySQL root credentials. The file sets a static MYSQL_ROOT_PASSWORD and publishes MySQL port 3306 on all interfaces.
An attacker who can reach port 3306, or who has access to the shared dbgptnet Docker network, can log in as root@% on any deployment where the default password has not been changed. That account has full database access, including the FILE and SUPER privileges.
The vulnerability was disclosed by VulnCheck and published to NVD. NVD currently lists its status as "Deferred."
Why It Matters
VulnCheck rates this issue 9.8 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. According to that scoring, exploitation:
- works over the network
- is low complexity
- needs no privileges
- needs no user interaction
A successful attack has high impact on confidentiality, integrity and availability.
Root access with FILE and SUPER privileges goes beyond reading data. It gives an attacker administrative control over the MySQL instance that backs a DB-GPT deployment. Any deployment that used the default compose file without changing the credentials or restricting the exposed port should be treated as potentially exposed.
KEV status: CVE-2026-77933 is not in the supplied CISA KEV data. Active exploitation has not been confirmed by KEV at the time of writing.
What's Vulnerable
- Vendor: eosphoros-ai
- Product: DB-GPT
- Affected versions: all versions through 0.8.2 (semver
0to<= 0.8.2) - Affected component: the default
docker-compose.ymldeployment, specifically the MySQL service configuration - Package:
pkg:github/eosphoros-ai/DB-GPT
Patch Status
The supplied NVD record does not name a fixed version or an official patch. CISA has not issued a required action, because the CVE is not in the supplied KEV data.
Until a fix is confirmed, operators running DB-GPT with the default compose file should check the VulnCheck advisory listed below for remediation guidance and watch the DB-GPT GitHub repository for vendor updates. They should also check whether their configured MySQL root password and the exposure of port 3306 still match the defaults described in this advisory.