DB-GPT Unauthenticated RCE and Hardcoded Credentials

DB-GPT through 0.8.2 ships a default docker-compose.yml that hardcodes the MySQL root password and publishes port 3306 on every host interface, so any instance deployed with the stock configuration exposes a root@% database account with publicly known credentials. An unauthenticated remote attacker who can reach port 3306, or who has a foothold on the shared 'dbgptnet' Docker bridge network, can log in with that static password and inherit FILE and SUPER privileges - full read/write access to all DB-GPT data plus the ability to read or write files on the database host. Publicly available exploit code exists (referenced by VulnCheck and Lasso Security); the issue is not in CISA KEV, but any deployment left in its default state is directly exploitable, and operators who rotated the root password, bound 3306 to localhost, or firewalled the host are materially less exposed.

Unauthenticated remote code execution in DB-GPT through 0.8.2 allows remote attackers to reach the /api/v1/chat/react-agent endpoint, where a mock get_user_from_headers function grants every caller the admin role. Crafted prompts can cause the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools to execute arbitrary Python or bash as root in the webserver container, potentially reaching the bundled database with default credentials. Publicly available exploit code exists; the provided data does not confirm active exploitation, and the assessed CVSS 3.1 severity is 9.3 with network access, no privileges, and no user interaction required when the endpoint and interpreter tools are deployed and reachable.