CVE-2026-77933
Deferred Deferred - Pending Action

Hardcoded MySQL Root Credentials in DB-GPT Docker Setup

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-77933
EUVD
EUVD-2026-104689

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eosphoros-ai DB-GPT 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1392 The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DB-GPT through 0.8.2 has a hardcoded MySQL root password in its default docker-compose.yml file. This sets a static MYSQL_ROOT_PASSWORD and exposes port 3306 on all interfaces, allowing attackers to connect and authenticate as root with full database privileges.

Detection Guidance

Check if port 3306 is open on any interface using netstat or ss commands like 'netstat -tuln | grep 3306' or 'ss -tuln | grep 3306'. Inspect Docker containers running DB-GPT with 'docker ps' and check their configurations. Look for exposed port 3306 in docker-compose.yml files.

Impact Analysis

Attackers can gain full database access, including FILE and SUPER privileges, by reaching port 3306 or the shared dbgptnet network. This could lead to data theft, manipulation, or complete database compromise.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls in GDPR and HIPAA. Unauthorized database access risks exposing sensitive personal or health data, leading to legal and regulatory penalties.

Mitigation Strategies

Remove hardcoded credentials in docker-compose.yml and set a strong, unique MYSQL_ROOT_PASSWORD. Avoid exposing port 3306 publicly. Restrict network access to the MySQL container. Update to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77933. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...