Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-20

HighPrimary

Unauthenticated Prompts Can Make DB-GPT Agents Execute Code as Container Root

Lasso's CVE-2026-77932 disclosure reports an end-to-end DB-GPT test where mock authentication granted every caller an admin role. An unauthenticated prompt.

DB-GPT ReAct agentGovernance bypassControlled agent-action researchReAct API authentication and interpreter execution boundary

What happened

Emitting and executing interpreter calls after an unauthenticated request, with root privileges inside the webserver container

Why it matters

Confirmed container-root code execution and one database-authentication leg in researcher tests; no host escape is established.

Missing authorization check

Independent authorization for emitting and executing interpreter calls after an unauthenticated request, with root privileges inside the webserver container

Would PP block it?

The enforcement point would need to verify the caller, resolved operation, target, parameters and approved task before execution. This is a conditional assessment, not a demonstrated PP prevention result for this case.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-20

    The cited source discloses the behavior documented in this record.

Technical breakdown

  • Lasso's CVE-2026-77932 disclosure reports an end-to-end DB-GPT test where mock authentication granted every caller an admin role. An unauthenticated prompt reached the ReAct agent; local Llama and Qwen models emitted code_interpreter calls, and the researcher confirmed a marker file and root identity inside the webserver container. One run also accessed the bundled database using default credentials. The evidence concerns controlled tests, not an observed production breach.
  • Emitting and executing interpreter calls after an unauthenticated request, with root privileges inside the webserver container
  • Confirmed container-root code execution and one database-authentication leg in researcher tests; no host escape is established.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
ReAct API authentication and interpreter execution boundary
Still needs
PP does not repair the underlying application or sandbox, infer valid authority from a prompt, or cover direct effects that bypass an integrated gate. Separate isolation and least-privilege controls remain necessary.
Receipt required for
Emitting and executing interpreter calls after an unauthenticated request, with root privileges inside the webserver container

An independent authorization boundary could hold the described operation when the exact action is routed through an integrated enforcement point.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop