CVE-2026-77926: Exposed Dangerous Method or Function in apconw Aix-DB

CVE-2026-77926 is a remote code execution vulnerability in Aix-DB 1.2.4. It arises from an exposed dangerous method in the ChatBI common agent's deepagents execute tool, which lacks proper gating and allows authenticated non-admin users to run arbitrary OS commands. Exploitation vectors include crafted chat inputs to the POST /dify/get_answer endpoint and uploading malicious documents. Successful exploitation can lead to disclosure of datasource credentials and model API keys, compromising system integrity and confidentiality.

Authenticated non-admin users can execute arbitrary operating system commands on the host running Aix-DB 1.2.4. This can lead to exposure of sensitive datasource credentials and model API keys, potentially allowing further unauthorized access or data compromise. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.7.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to authenticated users and monitor for suspicious activity related to the POST /dify/get_answer endpoint and document uploads. Avoid uploading untrusted documents and limit permissions of non-admin users where possible.