Is CVE-2026-77933 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77933 being exploited in the wild.

How severe is CVE-2026-77933?

Critical severity, with a CVSS score of 9.8, published 20 October 2026.

Which products and versions are affected?

Eosphoros-Ai DB-GPT through 0.8.2.

How is CVE-2026-77933 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-77933?

Check whether you run Eosphoros-Ai DB-GPT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77933: DB-GPT hardcoded credentials in default Docker configuration

CVE-2026-77933 · Severity: critical · CVSS 9.8 · Published 2026-10-20

DB-GPT is an open-source AI data assistant that ships with a default Docker configuration containing hardcoded MySQL root credentials and an exposed database port. An attacker who can reach the published port or connect to the Docker network can log in as the database superuser and read, modify, or delete all application data and customer information.

Technologies: Eosphoros-Ai DB-GPT. Vendors: Eosphoros-Ai.

Quick answers

Is CVE-2026-77933 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77933 being exploited in the wild.
How severe is CVE-2026-77933?: Critical severity, with a CVSS score of 9.8, published 20 October 2026.
Which products and versions are affected?: Eosphoros-Ai DB-GPT through 0.8.2.
Is there a fix for CVE-2026-77933?: No fixed version is recorded yet. Immediately change the MYSQL_ROOT_PASSWORD value in docker-compose.yml to a unique credential, bind MySQL to 127.0.0.1 only (remove the host port publish), and create a non-superuser database role for the webserver application instead of using root credentials. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77933 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-77933?: Check whether you run Eosphoros-Ai DB-GPT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Immediately change the MYSQL_ROOT_PASSWORD value in docker-compose.yml to a unique credential, bind MySQL to 127.0.0.1 only (remove the host port publish), and create a non-superuser database role for the webserver application instead of using root credentials.

Technical details

The default docker-compose.yml hardcodes MYSQL_ROOT_PASSWORD as 'aa123456' and publishes port 3306 to the host. The webserver container is configured to connect as the MySQL root user with the same credential. Any network client reaching the host port or a container on the shared Docker network can authenticate as root@% and exploit FILE and SUPER privileges to manipulate databases. The vulnerability exists in the shipped configuration file and cannot be rotated without modifying the compose file.

Affected products

eosphoros-ai DB-GPT through 0.8.2

Timeline

2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.