Cases › security breach › LR-2026-0138
DB-GPT 0.8.0 unauthenticated RCE via sandbox fallback and skill_upload directory traversal (CVE-2026-51862, CVE-2026-51869)
Severity major: The failure to secure these defaults leaves a substantial portion of the agentic ecosystem exposed to unauthorized data access and system control, an unbounded scope across many deployers.
Earliest source we hold 2026-10-08
DB-GPT 0.8.0, an open-source platform bridging AI agents to databases and knowledge bases, contains two unauthenticated RCE flaws: CVE-2026-51862 (CVSS 9.1), a directory traversal in the skill_upload endpoint, and CVE-2026-51869 (CVSS 9.8), a sandbox failure where the platform silently falls back to LocalRuntime and executes code on the host.
Risk grouping: AI used to exploit
| Who caused it | A person or organisation “By uploading a CSV file to the web interface and requesting analysis, an attacker can force an AI agent to generate and execute code on the host, successfully creating a marker file at /tmp/dbgpt_web_unsandboxed.txt.” source |
|---|---|
| Intended or not | Intended “By uploading a CSV file to the web interface and requesting analysis, an attacker can force an AI agent to generate and execute code on the host, successfully creating a marker file at /tmp/dbgpt_web_unsandboxed.txt.” source |
| Before or after release | After release “Organizations currently deploying DB-GPT 0.8.0 should treat their installations as compromised and prioritize immediate isolation or migration to a more secure architecture.” source |
| The AI's part | Used as a tool “By uploading a CSV file to the web interface and requesting analysis, an attacker can force an AI agent to generate and execute code on the host, successfully creating a marker file at /tmp/dbgpt_web_unsandboxed.txt.” source |
The story
1 · What it was doingDB-GPT 0.8.0, an open-source agent platform, was bridging autonomous AI agents to databases and knowledge bases, running text2sql, RAG and autonomous code execution for enterprises, with access to the host filesystem through its runtime.
2 · What went wrongTwo unauthenticated RCE flaws let a remote attacker write files outside the workspace and, when containerization tools were unavailable, the platform silently fell back to LocalRuntime and executed agent-generated code directly on the host, breaching the sandbox boundary.
3 · What it reached or didThe action reached the host filesystem of any organization running DB-GPT 0.8.0; a proof-of-concept created a marker file at /tmp/dbgpt_web_unsandboxed.txt, and the exposure extends to unauthorized data access and system control across the agentic ecosystem.
4 · How it was caughtResearcher Ro1ME documented the proof-of-concept in GitHub issue #3082, showing a CSV upload forcing agent code execution on the host.
5 · What was doneNo patched versions are listed in the official advisories; organizations running 0.8.0 are told to treat installations as compromised and isolate or migrate to a more secure architecture.
Others like this
Safeguards a source says failed
Agent limits failed: “This flaw stems from a failure in the platform’s sandbox mechanism.”
Agent limits absent: “Because the platform fails to implement a fail-closed policy or issue a warning, it proceeds to execute code directly on the host filesystem.”
Agent limits bypassed: “The platform’s design choice effectively bypasses the security controls that developers and IT decision-makers assume are in place.”
A model read these from the sources; each quote was checked word for word against its source.
Show every field, with its source and grade
The AI system
Software around the model
DB-GPT
C one secondary source states it
Tools it was given
code execution, database, knowledge base, file upload
C one secondary source states it
What it was allowed to do
Intended to operate within a sandboxed workspace; when containerization tools are unavailable it falls back to a LocalRuntime and executes code directly on the host filesystem.
C one secondary source states it
Safeguards in place
sandbox
C one secondary source states it
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
C one secondary source states it
What it was for
Bridging autonomous AI agents with structured data sources like databases and knowledge bases, facilitating text2sql, RAG, and autonomous code execution.
C one secondary source states it
State of its safeguards
Sandbox mechanism present but silently falls back to LocalRuntime when containerization tools are unavailable; no fail-closed policy or warning.
C one secondary source states it
Meant for live use
yes
D inferred by us from the described behaviour, reason shown
What happened
Earliest source we hold
2026-10-08
A the date the source itself carries
Who caught it
an independent researcher or journalist
C one secondary source states it
Themes
RCE, sandbox escape, directory traversal, open source, unpatched
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
An uploaded CSV file submitted through the web interface
C one secondary source states it
What was stopped
Organizations are advised to isolate or migrate their DB-GPT 0.8.0 installations; no duration stated.
C one secondary source states it
What was done
No patched versions have been listed in the official advisories; organizations are advised to isolate or migrate to a more secure architecture.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
What it did
The sandbox mechanism failed: with containerization tools unavailable the platform silently falls back to LocalRuntime and executes code directly on the host filesystem, outside the intended workspace boundaries.
C one secondary source states it
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
Any organization utilizing DB-GPT 0.8.0; the underlying infrastructure of those organizations
C one secondary source states it
Why this severity
The failure to secure these defaults leaves a substantial portion of the agentic ecosystem exposed to unauthorized data access and system control, an unbounded scope across many deployers.
D inferred by us from the described behaviour, reason shown
Context
Industry
Information
D inferred by us from the described behaviour, reason shown
Shared exposure
one shared model or part put many users at risk
C one secondary source states it
Shared model
DB-GPT 0.8.0
C one secondary source states it
LR-2026-0138 · version 4 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON