CVE-2026-77926
Deferred Deferred - Pending Action

Aix-DB Remote Code Execution via ChatBI Agent

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-07
NVD
CVE-2026-77926
EUVD
EUVD-2026-104686

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apconw Aix-DB 1.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-749 The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77926 is a remote code execution vulnerability in Aix-DB 1.2.4. Authenticated non-admin users can run operating system commands via the ChatBI common agent's ungated deepagents execute tool. Attackers exploit this by sending crafted chat input to POST /dify/get_answer or uploading malicious documents, enabling command execution on the host system.

Detection Guidance

Monitor network traffic for POST requests to /dify/get_answer with unusual payloads. Check for unauthorized command execution logs in Aix-DB agent logs. Inspect uploaded documents for embedded malicious scripts or commands.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the host system, potentially leading to full system compromise. Sensitive data such as datasource credentials and model API keys may be exposed. Attackers could also escalate privileges or pivot to other systems within the network.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Aix-DB to a patched version above 1.2.4. Restrict access to the /dify/get_answer endpoint. Implement strict input validation for chat inputs and uploaded documents. Disable the Execute Tool for non-admin users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77926. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...