Overview

DB-GPT is an open-source agentic AI data assistant for building AI and data products. The docker-compose.yml the project ships sets the bundled MySQL root password to a fixed value, aa123456, publishes port 3306 to the host, and configures the DB-GPT webserver to connect as root with that same password.

‍

The root@% account holds FILE and SUPER privileges along with full access to every database. Anyone who can reach the published port, or any container on the shared Docker network, can authenticate as this superuser and read, modify or delete all data in the deployment.

‍

Because DB-GPT's shipped docker-compose.yml gives its MySQL database a hardcoded root password and publishes the database port to the host, anyone who can reach that port can log in as a database superuser and read, modify or delete every database, deployments should change the credential and stop publishing the port immediately..

‍

Affected Product

eosphoros-ai/DB-GPT

‍

Affected Files

• docker-compose.yml:9 - MYSQL_ROOT_PASSWORD: 'aa123456'
• docker-compose.yml:10-11 - ports: - 3306:3306
• docker-compose.yml:25-29 - webserver environment: MYSQL_USER=root, MYSQL_PASSWORD=aa123456
• docker/examples/my.cnf:29 - secure-file-priv=/var/lib/mysql-files

‍

Root Cause

The shipped docker-compose.yml hardcodes MYSQL_ROOT_PASSWORD: 'aa123456' for the bundled MySQL service, publishes port 3306 to the host, and configures the DB-GPT webserver to connect as the MySQL root superuser using the same hardcoded password.

‍

Both the host-facing port and the shared dbgptnet bridge network provide independent paths to authenticate as a MySQL root@% superuser, which holds FILE and SUPER privileges in addition to full data access across all databases.

‍

PoC

DB leg (self-contained, local, torn down):

1. Bring up the repo's db service in isolation (image mysql/mysql-server:8.0, MYSQL_ROOT_PASSWORD=aa123456, ports 3306:3306, repo my.cnf + init SQL).

2. From the host:

mysql -h 127.0.0.1 -uroot -paa123456 -e "SELECT VERSION(),CURRENT_USER();"

Returns: 8.0.32 / root@%

‍

3. From an ephemeral container on the shared network: connect to db:3306 as root@%; SHOW DATABASES returns all databases (dbgpt, case_1_student_manager, case_2_ecom, EXAMPLE_1, ...); cross-DB SELECT succeeds.

4. information_schema.USER_PRIVILEGES for root@% includes FILE, SUPER.

5. SELECT 'pwned_by_dbgpt_poc' INTO OUTFILE '/var/lib/mysql-files/poc_marker.txt' followed by LOAD_FILE read-back succeeds; UPDATE ... SET student_name='TAMPERED' succeeds.

6. Teardown: docker compose -p dbgptpoc -f _poc/docker-compose.poc.yml down -v (verified clean).

‍

Impact

Any network client that can reach the published host port 3306, or any container on the shared dbgptnet bridge network, can authenticate as MySQL root@% using the hardcoded credential and obtain full read, write, and administrative access to all databases in the deployment. The FILE privilege enables writing to and reading from the MySQL data directory (constrained to /var/lib/mysql-files by secure-file-priv, but not removed).

‍

Because the webserver itself connects as root, an attacker who can pivot from the webserver container can reach the DB with the same credential already present in the container's environment. The credential is static and cannot be rotated without modifying the shipped compose file.

‍

Suggested Remediation

1. Remove the hardcoded aa123456 password; generate a random credential on first run.

2. Create a non-superuser database role for the application and inject only that role's credentials into the webserver container.

3. Bind MySQL to 127.0.0.1 only, or remove the host port publish entirely.

4. Do not inject DB superuser credentials into a container that executes untrusted or LLM-generated code.

‍

Additional Resources

• CVE-2026-77933 record

‍