{"schema_version":"0.9.0","id":"LR-2026-0138","record_version":4,"title":"DB-GPT 0.8.0 unauthenticated RCE via sandbox fallback and skill_upload directory traversal (CVE-2026-51862, CVE-2026-51869)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":48.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-08","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"DB-GPT","tools_granted":["code_execution","database","knowledge_base","file_upload"],"permissions_scope":"Intended to operate within a sandboxed workspace; when containerization tools are unavailable it falls back to a LocalRuntime and executes code directly on the host filesystem.","autonomy_level":"unknown","guardrails_present":["sandbox"],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":"agentic_with_tools","intended_use":"Bridging autonomous AI agents with structured data sources like databases and knowledge bases, facilitating text2sql, RAG, and autonomous code execution.","safeguard_state":"Sandbox mechanism present but silently falls back to LocalRuntime when containerization tools are unavailable; no fail-closed policy or warning.","production_intended":true},"event":{"date_occurred":null,"date_disclosed":"2026-10-08","incident_class":"security_compromise","failure_class":"containment_escape","agent_involved":true,"secondary_failure_classes":["credential_misuse"],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"DB-GPT 0.8.0, an open-source platform bridging AI agents to databases and knowledge bases, contains two unauthenticated RCE flaws: CVE-2026-51862 (CVSS 9.1), a directory traversal in the skill_upload endpoint, and CVE-2026-51869 (CVSS 9.8), a sandbox failure where the platform silently falls back to LocalRuntime and executes code on the host.","tags":["rce","sandbox-escape","directory-traversal","open-source","unpatched"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"The sandbox mechanism failed: with containerization tools unavailable the platform silently falls back to LocalRuntime and executes code directly on the host filesystem, outside the intended workspace boundaries.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"An uploaded CSV file submitted through the web interface","time_to_contain":null,"operations_paused":"Organizations are advised to isolate or migrate their DB-GPT 0.8.0 installations; no duration stated.","remediation":"No patched versions have been listed in the official advisories; organizations are advised to isolate or migrate to a more secure architecture.","precursor_events":null,"control_failure":[{"element_id":"C04","state":"failed","quote":"This flaw stems from a failure in the platform’s sandbox mechanism.","source_index":0},{"element_id":"C04","state":"absent","quote":"Because the platform fails to implement a fail-closed policy or issue a warning, it proceeds to execute code directly on the host filesystem.","source_index":0},{"element_id":"C04","state":"bypassed","quote":"The platform’s design choice effectively bypasses the security controls that developers and IT decision-makers assume are in place.","source_index":0}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: The failure to secure these defaults leaves a substantial portion of the agentic ecosystem exposed to unauthorized data access and system control, an unbounded scope across many deployers.","harm_class":[],"affected_description":"Any organization utilizing DB-GPT 0.8.0; the underlying infrastructure of those organizations","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://forkast.news/db-gpt-ai-agent-platform-two-critical-rce-cves-at-the-agent-data-access-layer/","publisher":"news search (Google News index)","date":"2026-10-08","type":"press","title":"DB-GPT AI Agent Platform: Two Critical RCE CVEs at the Agent Data Access Layer","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"C","system.permissions_scope":"C","system.guardrails_present":"C","system.lifecycle_stage":"D","system.integration_type":"C","system.intended_use":"C","system.safeguard_state":"C","system.production_intended":"D","system.deployment_context":"D","system.developer":"D","system.autonomy_level":"D","event.failure_class":"C","event.secondary_failure_classes":"D","event.tags":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.operations_paused":"C","event.remediation":"C","event.agent_involved":"C","event.detection_method":"C","event.summary":"C","event.incident_class":"C","event.date_disclosed":"A","event.trigger":"D","impact.affected_description":"C","impact.severity":"D","context.industry":"D","context.systemic_exposure":"C","context.shared_model_id":"C","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"C","impact.severity_because":"D","event.control_failure":"C"},"field_citations":{"system.harness":[{"source_index":0,"quote":"DB-GPT functions as a critical intermediary layer, bridging autonomous AI agents with structured data sources like databases and knowledge bases."}],"system.tools_granted":[{"source_index":0,"quote":"By design, this platform acts as the gatekeeper for sensitive enterprise information, facilitating complex operations such as text2sql, RAG, and autonomous code execution."}],"system.permissions_scope":[{"source_index":0,"quote":"When containerization tools such as Docker, Podman, or Nerdctl are unavailable, the system silently falls back to a LocalRuntime environment."}],"system.guardrails_present":[{"source_index":0,"quote":"This flaw stems from a failure in the platform’s sandbox mechanism."}],"system.deployment_context":[{"source_index":0,"quote":"Organizations currently deploying DB-GPT 0.8.0 should treat their installations as compromised and prioritize immediate isolation or migration to a more secure architecture."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Organizations currently deploying DB-GPT 0.8.0 should treat their installations as compromised and prioritize immediate isolation or migration to a more secure architecture."}],"system.integration_type":[{"source_index":0,"quote":"DB-GPT functions as a critical intermediary layer, bridging autonomous AI agents with structured data sources like databases and knowledge bases."}],"system.intended_use":[{"source_index":0,"quote":"By design, this platform acts as the gatekeeper for sensitive enterprise information, facilitating complex operations such as text2sql, RAG, and autonomous code execution."}],"system.safeguard_state":[{"source_index":0,"quote":"When containerization tools such as Docker, Podman, or Nerdctl are unavailable, the system silently falls back to a LocalRuntime environment."}],"system.production_intended":[{"source_index":0,"quote":"Organizations currently deploying DB-GPT 0.8.0 should treat their installations as compromised and prioritize immediate isolation or migration to a more secure architecture."}],"event.failure_class":[{"source_index":0,"quote":"Because the platform fails to implement a fail-closed policy or issue a warning, it proceeds to execute code directly on the host filesystem."}],"event.secondary_failure_classes":[{"source_index":0,"quote":"This allows a remote attacker to write files outside of the intended workspace boundaries."}],"event.detection_method":[{"source_index":0,"quote":"A proof-of-concept documented in GitHub issue #3082 by researcher Ro1ME confirms the severity of this design."}],"event.summary":[{"source_index":0,"quote":"Two unauthenticated, network-exploitable remote code execution (RCE) vulnerabilities in version 0.8.0 of this platform, identified as CVE-2026-51862 and CVE-2026-51869, demonstrate how easily this gatekeeper role can be subverted."}],"event.tags":[{"source_index":0,"quote":"Two unauthenticated, network-exploitable remote code execution (RCE) vulnerabilities in version 0.8.0 of this platform, identified as CVE-2026-51862 and CVE-2026-51869, demonstrate how easily this gatekeeper role can be subverted."}],"event.adversarial_actor":[{"source_index":0,"quote":"This allows a remote attacker to write files outside of the intended workspace boundaries."}],"event.input_provenance":[{"source_index":0,"quote":"By uploading a CSV file to the web interface and requesting analysis, an attacker can force an AI agent to generate and execute code on the host, successfully creating a marker file at /tmp/dbgpt_web_unsandboxed.txt."}],"event.operations_paused":[{"source_index":0,"quote":"Organizations currently deploying DB-GPT 0.8.0 should treat their installations as compromised and prioritize immediate isolation or migration to a more secure architecture."}],"event.remediation":[{"source_index":0,"quote":"As of the latest updates, no patched versions have been listed in the official advisories for these CVEs, although the latest release on PyPI is 0.8.2."}],"event.incident_class":[{"source_index":0,"quote":"Two unauthenticated, network-exploitable remote code execution (RCE) vulnerabilities in version 0.8.0 of this platform, identified as CVE-2026-51862 and CVE-2026-51869, demonstrate how easily this gatekeeper role can be subverted."}],"event.agent_involved":[{"source_index":0,"quote":"By uploading a CSV file to the web interface and requesting analysis, an attacker can force an AI agent to generate and execute code on the host, successfully creating a marker file at /tmp/dbgpt_web_unsandboxed.txt."}],"event.failure_class_detail":[{"source_index":0,"quote":"This flaw stems from a failure in the platform’s sandbox mechanism."}],"impact.affected_description":[{"source_index":0,"quote":"The vulnerabilities present a direct threat to the underlying infrastructure of any organization utilizing the tool."}],"impact.severity_because":[{"source_index":0,"quote":"Given the platform’s significant deployment footprint, stemming from its status as an open-source tool with approximately 10,000 GitHub stars, the failure to secure these defaults leaves a substantial portion of the agentic ecosystem exposed to unauthorized data access and system control."}],"context.industry":[{"source_index":0,"quote":"DB-GPT functions as a critical intermediary layer, bridging autonomous AI agents with structured data sources like databases and knowledge bases."}],"context.systemic_exposure":[{"source_index":0,"quote":"Given the platform’s significant deployment footprint, stemming from its status as an open-source tool with approximately 10,000 GitHub stars, the failure to secure these defaults leaves a substantial portion of the agentic ecosystem exposed to unauthorized data access and system control."}],"context.shared_model_id":[{"source_index":0,"quote":"Two unauthenticated, network-exploitable remote code execution (RCE) vulnerabilities in version 0.8.0 of this platform, identified as CVE-2026-51862 and CVE-2026-51869, demonstrate how easily this gatekeeper role can be subverted."}],"impact.severity":[{"source_index":0,"quote":"Given the platform’s significant deployment footprint, stemming from its status as an open-source tool with approximately 10,000 GitHub stars, the failure to secure these defaults leaves a substantial portion of the agentic ecosystem exposed to unauthorized data access and system control."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-08"}],"event.control_failure":[{"source_index":0,"quote":"This flaw stems from a failure in the platform’s sandbox mechanism."},{"source_index":0,"quote":"Because the platform fails to implement a fail-closed policy or issue a warning, it proceeds to execute code directly on the host filesystem."},{"source_index":0,"quote":"The platform’s design choice effectively bypasses the security controls that developers and IT decision-makers assume are in place."}]},"notes_on_gaps":"No source states event.date_occurred, event.date_disclosed, event.duration, event.time_to_contain, event.date_detected, event.trigger, event.near_miss, event.responsible_party, impact.direct_loss_usd, impact.remediation_hours, impact.records_exposed, impact.third_parties_affected_count, impact.harm_class, impact.reversibility, impact.downstream_exposure_count, impact.loss_range_usd, impact.protected_class_involved, impact.data_categories_exposed, context.org_size_band, context.country, context.denominator_available, context.denominator, context.upstream_incident_id, context.incident_evidence, context.regulatory, context.coverage, system.model_name, system.model_version, system.developer, system.autonomy_level. event.trigger omitted because no source states a cause. event.failure_class secondary credential_misuse is a grade-D classification from the file-write-outside-workspace sentence. context.industry 'Information' is a grade-D classification from the platform description. system.deployment_context and lifecycle_stage 'production' are grade-D classifications from the advisory to isolate running installations. impact.severity major rests on the unbounded-scope sentence; no loss figure is stated. event.root_cause: the stated reason names an absence, not a failed control: The sandbox mechanism existed but failed: RuntimeFactory.create() defaults SANDBOX_RUNTIME to 'local', and with no fail-closed policy or warning the platform executes code directly on the host filesystem. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-09] system.lifecycle_stage: production. system.production_intended: classified from described behaviour. system.deployment_context: production. system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. event.secondary_failure_classes: a source states the agent used a credential, key or token for a purpose or scope it was not granted. event.trigger: no source states a cause. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [control failure inferred by deepseek-chat, controlfail-2026-10-11.2, 2026-10-11] [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric]"},"context":{"industry":"Information","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":true,"shared_model_id":"DB-GPT 0.8.0","upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"DB-GPT 0.8.0, an open-source agent platform, was bridging autonomous AI agents to databases and knowledge bases, running text2sql, RAG and autonomous code execution for enterprises, with access to the host filesystem through its runtime.","quote":"DB-GPT functions as a critical intermediary layer, bridging autonomous AI agents with structured data sources like databases and knowledge bases.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Two unauthenticated RCE flaws let a remote attacker write files outside the workspace and, when containerization tools were unavailable, the platform silently fell back to LocalRuntime and executed agent-generated code directly on the host, breaching the sandbox boundary.","quote":"This allows a remote attacker to write files outside of the intended workspace boundaries.","source_index":0,"grade":"C"},{"step":"reached","text":"The action reached the host filesystem of any organization running DB-GPT 0.8.0; a proof-of-concept created a marker file at /tmp/dbgpt_web_unsandboxed.txt, and the exposure extends to unauthorized data access and system control across the agentic ecosystem.","quote":"By uploading a CSV file to the web interface and requesting analysis, an attacker can force an AI agent to generate and execute code on the host, successfully creating a marker file at /tmp/dbgpt_web_unsandboxed.txt.","source_index":0,"grade":"C"},{"step":"caught","text":"Researcher Ro1ME documented the proof-of-concept in GitHub issue #3082, showing a CSV upload forcing agent code execution on the host.","quote":"A proof-of-concept documented in GitHub issue #3082 by researcher Ro1ME confirms the severity of this design.","source_index":0,"grade":"C"},{"step":"done","text":"No patched versions are listed in the official advisories; organizations running 0.8.0 are told to treat installations as compromised and isolate or migrate to a more secure architecture.","quote":"As of the latest updates, no patched versions have been listed in the official advisories for these CVEs, although the latest release on PyPI is 0.8.2.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-09","source_urls":["https://forkast.news/db-gpt-ai-agent-platform-two-critical-rce-cves-at-the-agent-data-access-layer/"]}}