PT-2026-43683 · Unknown · Dbgate-Serve

Published 2026-05-27 · Updated 2026-06-08 · CVE-2026-47668

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dbgate-serve versions prior to 7.1.9

Description An unauthenticated remote code execution issue exists in the database management tool. Attackers can achieve full system compromise without authentication or user interaction by injecting code through the functionName parameter within JSON script commands.

Recommendations Update dbgate-serve to version 7.1.9.

Fix

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-1188

CWE-20

Related Identifiers

CVE-2026-47668

GHSA-8V3Q-9VMX-36VC

Affected Products

Dbgate-Serve

References · 9

• https://osv.dev/vulnerability/GHSA-8v3q-9vmx-36vc · Vendor Advisory
• https://github.com/dbgate/dbgate/releases/tag/v7.1.9 · Note
• https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc · Note
• https://github.com/dbgate/dbgate · Note
• https://github.com/runZeroInc/nuclei-templates/blob/main/http/vulnerabilities/dbgate-unauth-rce.yaml · Note
• https://twitter.com/vuln_tracker/status/2059537522699682183 · Twitter Post
• https://twitter.com/UpwindMDR/status/2062947268307587535 · Twitter Post
• https://twitter.com/NetSecIO/status/2064014206450455032 · Twitter Post
• https://twitter.com/SecAlertsCo/status/2062981716042555665 · Twitter Post