CVE-2026-77933: Use of Default Credentials in eosphoros-ai DB-GPT
Description
DB-GPT versions up to 0.8.2 have a vulnerability due to hardcoded default credentials in the default docker-compose.yml file. This configuration sets a static MYSQL_ROOT_PASSWORD and exposes port 3306 on all network interfaces, allowing attackers with network access to authenticate as root and gain full database privileges.
CVSS v4.0
Score 9.3critical
Affected software
eosphoros-ai
DB-GPT
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77933 describes a hardcoded credentials vulnerability in eosphoros-ai's DB-GPT product through version 0.8.2. The default docker-compose.yml file sets a static MYSQL_ROOT_PASSWORD and publishes MySQL's port 3306 on all interfaces. This allows an attacker who can reach port 3306 or the shared dbgptnet Docker network to authenticate as root@% and obtain full database access, including FILE and SUPER privileges, which can lead to complete compromise of the database.
Potential Impact
An attacker with network access to the exposed MySQL port or the shared Docker network can authenticate as the root user without needing to know a unique password. This grants full control over the database, including high-privilege operations such as FILE and SUPER privileges, potentially leading to data theft, data manipulation, or further system compromise.
Mitigation Recommendations
No official patch or fix is currently referenced. Users should immediately change the default MYSQL_ROOT_PASSWORD in the docker-compose.yml file and restrict network exposure of port 3306 to trusted interfaces only. Additionally, avoid using the default docker-compose.yml configuration in production environments. Monitor vendor advisories for any forthcoming official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-21T17:52:36.079Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad6c1972cdf04f656e49572
Added to database: 10/20/2026, 01:19:19 UTC
Last enriched: 10/20/2026, 01:33:27 UTC
Last updated: 10/20/2026, 01:34:17 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.