What happened
DB-GPT through 0.8.2 has an unauthenticated RCE in the /api/v1/chat/react-agent endpoint, which relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts driving the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools to run arbitrary Python/bash as root in the webserver container, including reaching the bundled database with default credentials.
Why it matters
DB-GPT is an open-source agentic data framework that couples an LLM agent to a database; the apparent intent is to keep the agent sandboxed, but the mock auth object defeats that. An attacker gets pre-auth root in the container and direct access to the datasource the agent is meant to serve, enabling data exfiltration, model-pipeline tampering and lateral movement.
Attack vector
Unauthenticated prompt to /api/v1/chat/react-agent that drives the unsandboxed code_interpreter/shell_interpreter tools
Affected systems
DB-GPT <= 0.8.2 (pypi dbgpt-app)
Mitigation
Upgrade to a fixed release and replace the mock user-resolution with real authentication/RBAC; sandbox the agent's code/shell tools