high Cve 2026 77932 · AI Security

Five Open-Source AI Agent Platforms Hand a Shell to Anyone Who Can Reach Them or Feed Them Text

Data graphic: six CVEs across five open-source AI agent platforms let anyone who can reach them, or feed them text, run a shell, with severity up to CVSS 4.0 9.3 VulnCheck . A stamp notes that the only fix stated is EvoScientist 0.2.5; the other four platforms have no fix stated.

Nadia Shah
Identity security analyst · Published Oct 24, 2026, 5:13 PM EDT

Six CVEs in DB-GPT, Langchain-Chatchat, EvoScientist, LangAlpha and OpenSRE let unauthenticated callers or injected text reach a shell. Only one has a fix.

Six CVEs published in mid-October 2026 cover five open-source agent platforms: DB-GPT, Langchain-Chatchat, EvoScientist, LangAlpha and OpenSRE. Lasso Security researchers Noy Pearl, Michael Sromin and Ophir Dror found them, and VulnCheck assigned the identifiers and credits the same three. In each case a path to a host or container shell sits behind either no authentication at all or an approval gate that a sub-agent, scheduler or headless run never reaches. Of the five products, only EvoScientist has a fix that the sources show. For the other four, neither advisory page states a patched version, and the release pages we checked show none.

Two ways in

The six CVEs reduce to one bug class with two entrances.

No authentication on the agent endpoint. DB-GPT (CVE-2026-77932, versions up to 0.8.2) exposes a ReAct agent at /api/v1/chat/react-agent. Its get_user_from_headers function is a mock that returns an admin user for every request. The agent's code_interpreter tool runs model-generated Python as a plain subprocess. Its shell_interpreter tool runs bash on the host and imports LocalRuntime directly, bypassing the project's SANDBOX_ALLOW_LOCAL_RUNTIME guard. Both run as root in the webserver container. Lasso's proof of concept used v0.8.1 with local models. Exploitation depends on the model emitting the tool call: llama3.1:8b and qwen3:8b did, mistral:7b failed on tool-call formatting. In one run the interpreter also logged into the co-located MySQL with default credentials.

That default credential is a separate CVE, CVE-2026-77933 (CWE-1392). DB-GPT's shipped docker-compose.yml sets a fixed MySQL root password, publishes port 3306 to the host, and connects the web server as root. Anyone who reaches the port gets a superuser with FILE and SUPER privileges. The same credential sits in the environment of the container an attacker has just compromised.

Langchain-Chatchat (CVE-2026-75128, up to 0.3.1.3) has the same shape. POST /tools/call invokes any registered tool by name with no authentication, and it ignores the per-tool "use" flag meant to keep dangerous tools away from the agent. A shell tool is always registered. The API server binds to 0.0.0.0 on port 7861 by default, the shipped compose file uses host networking, and the shipped image runs as root. The command runs before the response is serialized, so the endpoint returns an error even when the attack worked.

Approval gates that sub-agents and headless paths skip. The other three products do require approval somewhere, just not on the path that matters.

EvoScientist (CVE-2026-77930, 0.1.0 up to but not including 0.2.5). Async sub-agents such as the scheduler were built without interrupt_on or excluded_tools, so the deepagents framework added its built-in execute tool anyway. The only guard was a seven-command denylist (sudo, chmod, chown, mkfs, dd, shutdown, reboot). In the documented EvoSci serve --auto-approve deployment, which accepts messaging-channel input, content the agent ingests could run commands as the process owner and read environment secrets.
LangAlpha (CVE-2026-109440, up to 2026.09.07). The Bash and ExecuteCode tools are always bound, with no allow-list and no human-in-the-loop interrupt. The same agent fetches web pages, filings and news. Injected instructions run in the user's per-workspace sandbox, which holds vault secrets in _internal/.vault_secrets.json and has outbound network access. The secrets file is protected only by a natural-language prompt. Scheduled automations run the same agent with nobody watching.
OpenSRE (CVE-2026-109444, up to 0.1.2026.10.19). The shell_run and cli_exec tools never set requires_approval. The headless presenter's execution_allowed returns True unconditionally and its factory discards the confirmation callback; that presenter is installed process-wide for gateway, scheduled and embedded runs. The shell policy allows any non-empty command, the child process inherits the full environment, and a fail-open messaging branch (pairing disabled, empty allow-list) lets an unauthenticated messaging user reach the ungated tools directly. The injection vector Lasso names is a forwarded Grafana or Loki alert. Against local qwen3:8b and qwen3:14b, injected commands ran, including kubectl config changes and sudo systemctl restart.

The six CVEs come down to two missing gates: no authentication on the agent endpoint, and no approval on sub-agent, scheduler or headless paths.

Scores do not agree

The headline number depends on who scored it. Lasso lists 9.8 for both DB-GPT CVEs and Langchain-Chatchat, 9.9 for EvoScientist, 9.6 for LangAlpha and 9.0 for OpenSRE, without a CVSS version or vector. VulnCheck's own advisories give 9.3 under CVSS 4.0 for DB-GPT (both), Langchain-Chatchat, EvoScientist and OpenSRE, and 8.6 for LangAlpha. A third-party NVD mirror shows LangAlpha at 8.1 under CVSS 3.1 with user interaction required. Treat all of these as critical or high, and do not quote one figure without naming its source. Lasso's database marks none of the six as having a known exploit.

Fix status

EvoScientist 0.2.5 is the only product with a fix in the sources. The tracking issue (#387) was opened on 24 July and closed on 31 July via PR #396, ahead of the October advisories. The commit, titled "unified HITL approval for sync + async sub-agents," brings approval to sync sub-agents and makes the research async agents refuse piped-to-interpreter commands and recursive deletes, relaying the refusal to the orchestrator. The release notes we read do not say outright that the scheduler's execute tool is closed, so check that before treating 0.2.5 as complete.

For the rest, the advisory pages state no patched version. DB-GPT's newest release on its releases page is v0.8.2, the version the advisory lists as affected. The Langchain-Chatchat page shows nothing after v0.3.1. OpenSRE shipped releases through 24 October, but the entries we read cover dependency bumps and code-scanning fixes, not shell_run. LangAlpha's later releases carry no security changelog. Absence from a changelog is not proof of no fix, so confirm against the repositories.

What defenders should do

Find these tools in your estate: internal DB-GPT, Chatchat, OpenSRE and LangAlpha instances are easy to forget. Take any that is reachable from an untrusted network off it, or put authentication in front of it.
Upgrade EvoScientist to 0.2.5 or later and do not run --auto-approve with channels you do not control.
For DB-GPT, change the MySQL root password, stop publishing 3306, and give the web server a non-superuser role.
Rotate every secret in the environment of any instance that was exposed: model API keys, database URLs, Slack, Grafana, Datadog and cloud credentials.
In agent code you run or write, require approval on shell and code tools for every execution path, including sub-agents, schedulers and headless runs. Fail closed when no approver exists. Do not use a denylist or a prompt as the boundary, and pass child processes a scoped environment.
Treat alert text, web pages and filings as untrusted input that can carry instructions.

This is the same class as the MoviePilot assistant flaw we covered earlier (CVE-2026-77931), disclosed in the same Lasso run.

Five Open-Source AI Agent Platforms Hand a Shell to Anyone Who Can Reach Them or Feed Them Text

Two ways in

Scores do not agree

Fix status

What defenders should do

Sources

Keep reading