2026-10-21 · 2026-Q4
DB-GPT and Vibe-Trading Agents Run Attacker Commands as Root (CVE-2026-77932, CVE-2026-114107)
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
DB-GPT through 0.8.2 and HKUDS Vibe-Trading, an AI trading agent, 0.1.0 before 0.1.7
Impact
In DB-GPT (CVSS 9.3, published October 20, 2026), the `/api/v1/chat/react-agent` endpoint uses a mock user lookup that gives every caller the admin role, so an unauthenticated prompt makes the agent's code and shell interpreter tools run Python or bash as root and reach the bundled database with default credentials. In Vibe-Trading (CVSS 8.7, October 21), instructions planted in a document or web page the agent reads lead to shell commands as root, and its URL tool allows SSRF
Root cause
Model-emitted commands passed to `subprocess.run` with `shell=True` and no allowlist or approval step, behind authentication that was stubbed out or absent
CVEs
Sources
Catalog
Cite this: AgentProv incident record: DB-GPT and Vibe-Trading Agents Run Attacker Commands as Root (CVE-2026-77932, CVE-2026-114107) (2026-10-21). https://agentprov.com/incidents/2026-10-21-db-gpt-and-vibe-trading-agents-run-attacker-commands-as-root-cve-2026-77932-cve
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run