{"schema":"threatline.record/2","record":{"id":"CVE-2026-77933","aliases":[],"summary":"DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment","details":"DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.","categories":["Unclassified"],"product":"DB-GPT","vendor":"eosphoros-ai","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77933","source_modified_at":"2026-10-20T13:49:14.362Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"DB-GPT","vendor":"eosphoros-ai","versions":[{"version":"0","lessThanOrEqual":"0.8.2","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00349,"percentile":0.27333,"score_date":"2026-10-23"},"published_at":"2026-10-20T00:46:12.076Z","modified_at":"2026-10-20T13:49:14.362Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-77933","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T13:49:14.362Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77933","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.lasso.security/vulnerability-database/cve-2026-77933","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://github.com/eosphoros-ai/DB-GPT/blob/83609c471266607490b24e72188311efa23a0d16/docker-compose.yml#L9","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/db-gpt-through-0.8.2-hardcoded-mysql-root-credentials-in-docker-compose-deployment","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-20T13:49:01.332782Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T13:49:14.362Z","content_hash":"9ee024510f16dec0bbce46bd0b3bdc4e185a5afe042afbc1861daaf238072c84"}}