Database/AI/ML frameworks & serving
DB-GPT: shipped docker-compose sets a static MySQL root password and publishes 3306 on all interfaces
Impact
The default compose file hardcodes MYSQL_ROOT_PASSWORD and binds port 3306 to 0.0.0.0, so anyone who can reach the host on that port logs in as root@% with a password that is public in the repository. Root in MySQL here carries FILE and SUPER, which means reading files the mysqld user can see and writing files back out - a path from database access toward code execution on the node. Any workload already on the shared dbgptnet bridge gets the same access without crossing the host network at all. For an operator this is a GPU node whose data plane is open to every tenant and every machine on the same subnet.
Who can reach it
Anyone who can reach TCP 3306 on the host, or any container attached to the dbgptnet Docker network. Authentication is required but the credential is published.
What to do
The record names no fixed version - all releases through 0.8.2 ship the default. Edit the compose file: set a unique root password, drop the 3306 host port publication so the database is reachable only inside the Docker network, then recreate the database and application containers so the new settings take effect. Rotate anything that MySQL root could have read.
References
Related entries
- llama.cpp llama-server: use-after-free and double free in the chat tool-call parser reachable from /completionCVE-2026-107183 · llama.cpp llama-server (common_chat_peg_mapper::map tool-call parser)Critical
- SGLang: unauthenticated debug dumper endpoint executes Python in the scheduler processCVE-2026-111391 · SGLang debug dumper (/dumper/configure filter expression)Critical
- vLLM: request-controlled processor code_revision loads arbitrary remote model code, giving RCECVE-2026-114053 · vLLM OpenAI-compatible API server (mm_processor_kwargs.code_revision handling)Critical
- Crawl4AI: file:// URLs accepted by four endpoints let an unauthenticated caller read any file on the hostCVE-2026-26217 · Crawl4AI Docker API (file:// URL handling in /execute_js, /screenshot, /pdf, /html)Critical
- llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCECVE-2026-39909 · llama.cpp RPC server (GRAPH_RECOMPUTE handler)Critical
- llama.cpp llama-server: use-after-free on the vocab pointer during idle sleep gives unauthenticated RCECVE-2026-43631 · llama.cpp llama-server (--sleep-idle-seconds idle transition)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.