CVE-2026-77932: DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed codeinterpreter and shellinterpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.