DB-GPT EUVD-2026-104688

No special conditions - remote unauthenticated exploitation against default configurations of DB-GPT (eosphoros-ai) through version 0.8.2, where the /api/v1/chat/react-agent endpoint and its code_interpreter/shell_interpreter tools are enabled and network-reachable. The mock get_user_from_headers function that grants admin to every caller is the default auth implementation, so no misconfiguration by the operator is required. Limiting factors: the DB-GPT instance must be network-exposed, the ReAct agent endpoint with its interpreter tools must be deployed, and only versions up to 0.8.2 are affected. No user interaction, authentication, or privileged access is needed, and the interpreter tools run unsandboxed as root inside the webserver container.

All available signals point to a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation yielding full confidentiality, integrity, and availability impact, and the description corroborates every one of those metrics: the /api/v1/chat/react-agent endpoint is reachable over the network and a mock get_user_from_headers function grants every caller the admin role (CWE-306), so no authentication is required. A public POC is reported by VulnCheck and referenced via Lasso Security, meaning working exploit code exists and the barrier to opportunistic attacks is low. The one caveat is that the vulnerable code paths (unsandboxed code_interpreter/shell_interpreter tools exposed through the ReAct agent) must be deployed and network-exposed, which tempers mass-exploitation risk somewhat. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV at time of analysis, so there is no confirmation of active in-the-wild exploitation - the risk is driven by exploit availability plus trivial exploitation conditions, not by observed attacks. Net assessment: a real, actionable priority for anyone running an exposed DB-GPT instance, bounded by the product's relatively niche deployment footprint.

A remote attacker locates an internet-exposed DB-GPT instance and sends an unauthenticated HTTP request to /api/v1/chat/react-agent, which the mock authentication treats as an admin. The attacker submits a crafted prompt that drives the ReAct agent to invoke its unsandboxed code_interpreter or shell_interpreter tool, executing arbitrary Python or bash as root inside the webserver container and reaching the bundled database with default credentials. A publicly available exploit (reported by VulnCheck) makes this attack reproducible with minimal effort.