EUVD-2026-90414
GHSA-6f6h-q22j-2q75
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed DB-GPT sandbox API
-
ExploitSubmit crafted code payload
-
ExecutionSandbox silently falls back to LocalRuntime
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the DB-GPT v0.8.0 sandbox/code-execution API be reachable and that the intended isolated sandbox runtime be unavailable or misconfigured, which triggers the silent fallback to LocalRuntime and runs submitted code on the host rather than in isolation. The decisive condition is this fallback path being reached - any deployment relying on the sandbox for untrusted code is exposed. Limiting factors: the attacker must be able to reach the sandbox API, and while the NVD vector asserts PR:N (unauthenticated), authentication requirements are not confirmed from the provided data - an instance behind authentication or not exposing the code-execution feature substantially reduces real-world risk. Version is limited to v0.8.0 as stated in the description. |
| Impact | Signals conflict sharply. The NVD CVSS 3.1 base score is 9.8 critical (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), describing unauthenticated remote code execution with total confidentiality, integrity and availability impact - consistent with a sandbox escape that runs attacker-supplied code directly on the host. However, EPSS is only 0.20% (9th percentile), there is no CISA KEV listing (not actively exploited), and no POC flag is set in the input, so the raw criticality is not matched by evidence of real-world weaponization. One caveat: a referenced GitHub gist (Ro1ME) likely contains a writeup or proof-of-concept, which would raise practical exploitability, but this is not confirmed as working exploit code in the provided data. A second caveat on the vector itself: PR:N assumes the DB-GPT sandbox/code-execution API is reachable without authentication, which is typical of default DB-GPT deployments but is not independently verified; and the scope is marked S:U despite this being a sandbox-to-host escape, which arguably merits S:C. Net: a genuinely severe technical flaw (RCE on host) but, given low EPSS, no KEV, and a niche product footprint, it is a patch-promptly-but-not-emergency priority rather than a mass-exploitation threat - most likely relevant to targeted attacks against exposed DB-GPT instances. |
| Exploit ScenarioDerived | An attacker reaches an internet-exposed DB-GPT v0.8.0 sandbox/code-execution API endpoint and submits code expecting it to run in an isolated runtime. Because the intended sandbox runtime is unavailable or misconfigured, the API silently falls back to LocalRuntime and executes the attacker's code directly on the host operating system, yielding remote code execution. A referenced gist may document this exploitation path, though working exploit code is not confirmed in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Improper access control in DB-GPT v0.8.0 allows attacker-supplied code to run directly on the host: when the sandbox API cannot resolve its intended isolated runtime, it silently degrades to LocalRuntime instead of failing closed, so submitted code is executed outside the isolation boundary the deployment expected. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-284) and affects any instance that exposes the sandbox/code-execution API and relies on it to contain untrusted code; exploitation conditions require that the API be reachable and the intended runtime be unavailable or misconfigured. There is no confirmed actively exploited (CISA KEV) status and no public exploit identified at time of analysis, and EPSS is low at 0.20% (9th percentile), so the practical risk signals conflict sharply: a critical-severity, unauthenticated-per-vector code-execution path paired with minimal observed exploitation activity and a narrow, version-specific exposure window.
RemediationAI
No vendor-released patch identified at time of analysis: the supplied references contain only an upstream GitHub issue, a public gist, and the NVD record, and there is no fix commit, pull request, or tagged patched release in the input, so verify the state of https://github.com/eosphoros-ai/DB-GPT/issues/3082 before assuming a fix exists. Until a patched release is published, treat the fallback behavior as a fail-open code-execution path and compensate directly: disable or remove the sandbox/code-execution API on any DB-GPT v0.8.0 instance that does not strictly require it (side effect: loss of code-interpreter functionality), or, if the feature is required, terminate the endpoint at a reverse proxy and require authentication plus source allow-listing so the API is not reachable by unauthenticated or untrusted clients (side effect: added operational overhead and possible breakage of legitimate integrations). Ensure the isolated execution runtime is actually present and healthy and enforce fail-closed behavior at the deployment layer so that requests are refused rather than downgraded to LocalRuntime; run the DB-GPT service under a dedicated unprivileged account inside a container with a read-only root filesystem, dropped Linux capabilities, no host Docker socket or host mounts, and restricted egress, accepting that these constraints may break features that legitimately need host resources (side effect: reduced functionality and more complex deployments). Also block outbound and lateral network access from the DB-GPT host to limit post-execution impact, and monitor the upstream issue and NVD entry for the release of an official fixed version, at which point upgrading from 0.8.0 to that exact vendor-stated version becomes the primary remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DB-GPT is an open-source LLM application framework maintained by eosphoros-ai that includes a code-execution/sandbox capability used to run model-generated or user-submitted code. Architecturally, the sandbox layer is meant to select an isolated runtime (for example a containerized or remote execution backend) and execute submitted code there; the flaw described is a fail-open runtime-selection path in which the component silently falls back to LocalRuntime when the intended sandbox backend is missing, unavailable, or misconfigured, causing code to execute in the DB-GPT host process context rather than in isolation. The assigned CWE-284 (Improper Access Control) frames this as a broken security boundary: the isolation mechanism that should restrict code execution to a contained environment is bypassed not by an explicit exploit primitive but by an unchecked degradation path, giving the submitted code the privileges of the DB-GPT service account on the host. The provided CPE entry is a placeholder (cpe:2.3:a:n/a:n/a) and EUVD lists the affected version string as "n/a n/a", so version scoping rests on the description's statement of DB-GPT v0.8.0 and on the referenced upstream issue rather than on normalized CPE data; no patch commit or fixed release is present in the supplied references, which point only to a GitHub issue, a public gist, and the NVD record. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, but per the independent assessment the PR:N assertion is not corroborated by deployment data: authentication requirements are not confirmed from the available input, and instances placed behind authentication or not exposing the code-execution feature are materially less exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable sandbox API with silent LocalRuntime fallback yields unauthenticated host RCE (PR:N, AC:L) with full C/I/A impact; scope kept U, though sandbox-to-host escape could justify S:C.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
Executive ViewAI
DB-GPT v0.8.0, an open-source LLM data-application framework used to build and serve data-aware AI assistants, contains a network-reachable code-execution flaw in its sandbox API that lets a caller run arbitrary code directly on the host rather than inside the isolation boundary the deployment assumed was in place. Because the flaw triggers when the intended isolated runtime is missing or misconfigured, the very environments that believe they are sandboxing untrusted code may be silently executing it with full host privileges and access to any data, credentials, or network paths that host can reach. No vendor patch exists and no public exploit has been identified at time of analysis, so leadership should treat this as a configuration-dependent exposure whose urgency is driven by whether the code-execution endpoint is reachable and by how much sensitive data sits behind the affected instance.
No vendor-released patch identified at time of analysis. Interim mitigations: remove the sandbox/code-execution API from external and untrusted network reach (firewall, reverse-proxy, or WAF deny rules); disable the sandbox feature where it is not operationally required; ensure the intended isolated runtime (container/gVisor/Firecracker/Kubernetes-based isolation) is installed, functional, and enforced so the service cannot fall back to LocalRuntime; require authentication and restrict access to trusted internal identities; run DB-GPT with least privilege in a confined container with no host mounts or host networking and restricted egress; monitor sandbox API invocations and runtime-fallback events; rotate secrets on affected hosts; and treat any host running an exposed instance as untrusted until isolation is verified, with no public exploit identified at time of analysis and confirmed actively exploited status not reported (CISA KEV) for this CVE.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB