DB-GPT EUVD-2026-104689

Exploitation requires DB-GPT deployed using the shipped default docker-compose.yml, which sets a static MYSQL_ROOT_PASSWORD and publishes MySQL port 3306 on all interfaces (0.0.0.0), OR attacker access to the shared 'dbgptnet' Docker bridge network; the attacker then logs in as root@% with the publicly known password to obtain FILE and SUPER privileges. Limiting factors that reduce real-world risk: operators who changed the default root password, bound 3306 to localhost or removed the published port mapping, or firewalled the host are not remotely exploitable from outside the Docker network. There is no user interaction and no attacker-held credential requirement beyond the hardcoded value, so any instance left in the default state is directly exposed.

All available signals point to a genuinely high-priority issue for any DB-GPT instance deployed with the shipped Docker defaults. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated path with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), scoring 9.3 - consistent with the core defect: a static MYSQL_ROOT_PASSWORD plus port 3306 published on all interfaces. Public exploit code exists (reported by VulnCheck and catalogued by Lasso Security), which raises practical exploitability, but the vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of confirmed active exploitation or a quantified exploitation probability - treat exploitation as feasible and demonstrated, not confirmed in-the-wild. The one nuance to flag: the CVSS vector assumes default deployment; real-world risk is gated by whether operators left port 3306 exposed and kept the shipped password (see exploitation_conditions). Because the credential is hardcoded and publicly known, any exposed instance is effectively authentication-free for an attacker, so PR:N is justified. Net assessment: a real priority for exposed deployments, not merely a high-CVSS-but-low-real-risk theoretical flaw, though impact is bounded by the relatively narrow production footprint of the product.

An attacker scans for internet-exposed TCP port 3306 or gains a foothold on the shared dbgptnet Docker network, then connects to the MySQL instance and logs in as root@% using the publicly documented static MYSQL_ROOT_PASSWORD from DB-GPT's default docker-compose.yml. With FILE and SUPER privileges they read and modify all databases and can read/write files on the host filesystem. Public exploit material exists (VulnCheck/Lasso), so no novel research is required to carry this out.