CVE-2026-77933: DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQLROOTPASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote attack?
Deployments using the default docker-compose.yml are exposed if port 3306 is reachable by an attacker, because the configuration publishes MySQL on all interfaces. Systems or containers attached to the shared dbgptnet network are also exposed.
What access does an attacker gain after authenticating?
An attacker can authenticate as root@% and obtain full database access. The available privileges include FILE and SUPER.
Does exploitation require an existing account or user interaction?
No. The reported issue uses a static MySQL root password in the default docker-compose.yml, and the vulnerability metadata indicates no privileges or user interaction are required.