Quick answers
- Is CVE-2024-10906 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-10906 being exploited in the wild.
- How severe is CVE-2024-10906?
- Low severity, with a CVSS score of 3.1, published 7 July 2026.
- Which products and versions are affected?
- Eosphoros-Ai DB-GPT 0.x through 0.6.0; dbgpt (PyPI) ECOSYSTEM:introduced=0,last_affected=0.6.0.
- Is there a fix for CVE-2024-10906?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-10906 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-10906?
- Check whether you run Eosphoros-Ai DB-GPT or dbgpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) caused by overly permissive CORSMiddleware configuration in the uvicorn application, which sets Access-Control-Allow-Origin to * for all requests. This allows any web page to make authenticated cross-origin requests to the DB-GPT API endpoints. An attacker can craft a malicious webpage that, when visited by a user with access to the DB-GPT instance, automatically executes API calls on behalf of the victim. The vulnerable versions are 0.6.0 and all versions in the 0.* series up to 0.5.10; patched versions should restrict CORS origins to trusted domains only. No precondition such as network exposure is required—even internal instances are vulnerable if accessed by a user who visits a malicious site.
Affected products
- eosphoros-ai DB-GPT 0.x through 0.6.0
Identifiers
- CVE-2024-10906
- GHSA-3248-f932-c76p
- PYSEC-2026-1289
Timeline
- 2025-03-20: disclosed
- 2025-03-20: advisory