CriticalPublic exploitVulnerability

CVE-2026-47668

Unauthenticated Remote Code Execution in DbGate JSON Script Runner

Published Jul 23, 2026 · Updated today

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

CVSS10.0Critical · v3.1

EPSS3.9%90th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

IdentifiersCVE-2026-47668CWE-94 · Improper Control of Generation of…

CVE-2026-47668 is a code injection vulnerability in the JSON script runner of DbGate versions 7.1.8 and earlier. The runner concatenates the attacker-controlled functionName parameter of JSON script assign commands directly into dynamically generated JavaScript without adequate validation. The generated JavaScript executes in a forked Node.js child process, allowing injected code to execute operating-system commands. The runner also concatenates user-controlled variableName values into generated code. Default Anonymous authentication permits exploitation without existing credentials; authenticated deployments remain vulnerable to users with the necessary API access. DbGate 7.1.9 fixes the vulnerability.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can completely compromise the confidentiality, integrity, and availability of the DbGate host within the privileges and isolation boundaries of the service process. An attacker can execute commands, access or modify data available to DbGate, and disrupt the service. Root-level command execution was demonstrated against DbGate 7.1.8, but root access depends on the privileges under which the service runs.

Mitigation

If you can’t patch tonight, do this now.

Until patched, restrict network access to the DbGate API, particularly /runners/start and related runner endpoints, to trusted administrators. Explicitly enable authentication and disable Anonymous authentication. Authentication reduces unauthenticated exposure but does not eliminate exploitation by users with API access. Monitor for suspicious runner requests and unexpected child-process or shell execution originating from DbGate.

Remediation

Patch, then assume compromise.

Upgrade dbgate-serve to version 7.1.9 or later. Version 7.1.9 includes the patch and rejects the demonstrated malicious functionName input with an "Invalid functionName" error.

Public exploits

Exploits

3 exploits validated by Mallory's analysis.

View more in app →

CVE-2026-41179Repository is a small standalone proof-of-concept/test environment for exploiting rclone remote control command injection/RCE. Structure: (1) rce.py is the main exploit and only substantive code; it uses Python requests to POST attacker-controlled form data to the rclone RC API endpoint /operations/fsinfo. The malicious fs parameter declares a :webdav backend and injects a bearer_token_command value containing a URL-encoded bash -c command. A random uuid is added so repeated requests are re-executed. Two execution modes are implemented: a default 'dirty' mode that captures command output by piping stderr/stdout through base64 and parsing the encoded data from the JSON error string, and a blind mode that executes commands while forcing a benign exit path. (2) Containerfile builds a Debian-based lab image, downloads/install rclone 1.73.3, and starts rclone rcd bound to 0.0.0.0:5572. (3) run.sh builds and runs the container with Podman and publishes port 5572. (4) shell.sh opens an interactive shell in the running container. README identifies the repo as a test environment and references the advisory. Overall purpose: provide a reproducible local lab plus an operational Python exploit for unauthenticated or weakly exposed rclone RC services vulnerable to backend option command injection, yielding arbitrary command execution.s-vx · Disclosed Jul 27, 2026 · python · bash · network · webOperational CVE-2026-47668Repository is a small standalone proof-of-concept exploit for CVE-2026-47668, described as an unauthenticated RCE in DBGate <= 7.1.8. The main exploit logic is in rce.py, with two helper shell scripts for spinning up a local vulnerable container and opening a shell inside it. Structure: README.md documents the vulnerability and usage; rce.py is the exploit; run.sh launches DBGate 7.1.8-alpine via podman on port 3000; shell.sh opens an interactive shell in the test container. Exploit flow in rce.py: it first creates a requests session and POSTs to /auth/login with {"amoid":"none"}, then extracts accessToken from the JSON response and uses it as a Bearer token. It next POSTs a crafted JSON payload to /runners/start. The payload abuses the script/commands structure by injecting JavaScript into functionName, causing Node.js code execution via process.mainModule.require('child_process').execSync(...). Capabilities: two execution modes are implemented. The default mode attempts to write command stdout/stderr to the target's public directory as favicon.svg, waits 5 seconds, then fetches /favicon.svg over HTTP to display output. This gives practical unauthenticated RCE with output retrieval when DBGate runs with sufficient filesystem privileges. The blind mode (-b) still executes arbitrary shell commands but does not retrieve output. Both modes include cleanup logic that discovers the runner working directory and run ID from environment data, deletes files in the runner directory, removes the temporary directory, and deletes the uploaded JS payload from the uploads path. Notable technical details: the injected payload is minified with rjsmin before submission. The exploit relies on Node.js runtime internals and DBGate environment variables such as DBGATE_API to derive the application root and public directory. The README explicitly notes that output retrieval is privileged-dependent; otherwise the exploit remains blind. Overall, this is a real exploit rather than a detector. It is operational because it provides working command execution and output exfiltration logic, but payload customization is manual and not framework-driven.s-vx · Disclosed Jul 31, 2026 · python · bash · web · networkOperational CVE-2026-47668Repository contains a single substantial Python exploit tool, CVE-2026-47668.py, plus README, LICENSE, and requirements.txt. The script targets CVE-2026-47668, an unauthenticated/weakly authenticated remote code execution issue in DbGate/dbgate-serve <= 7.1.8 caused by unsafe embedding of user-controlled functionName and variableName fields into dynamically generated JavaScript for the JSON script runner. The exploit is not tied to a common framework; it is a standalone asyncio/aiohttp-based assessment and exploitation utility. Main capabilities: it normalizes target URLs, supports single-target and mass-target modes, attempts authentication via POST /auth/login to obtain a Bearer token when needed, probes the vulnerable runner, and sends an injected payload to POST /runners/start. It can execute arbitrary OS commands in the Node.js runner child process, collect output through an attacker-controlled HTTP callback listener, optionally base64-encode exfiltrated output, and optionally trigger a reverse TCP shell for single-target use. It also supports concurrency, timeout tuning, TLS verification control, vector selection (functionName, variableName, or both), and session/result logging. Operational structure: the script initializes an Nx/ output tree, including vuln.txt, dispatch.txt, revsh.txt, exfil.txt, failed.txt, list_report.txt, per-target exfil files, and session summaries. It includes CLI and wizard-style execution paths, built-in HTTP listener support for callbacks, reverse-shell listener configuration, and helper routines for URL normalization and target bookkeeping. README documents workflow as login -> probe -> POST /runners/start -> classify result as FAIL, VULN, DISPATCH, EXFIL, or REVSH. Fingerprintable targets/endpoints are primarily the DbGate web endpoints POST /auth/login and POST /runners/start, along with local output paths under Nx/. Default network assumptions include DbGate on port 3000, HTTP callback listener on port 8888, and reverse shell listener on port 4444. Overall, this is a real operational exploit/assessment tool with practical payload delivery and output confirmation, not merely a detector.Nxploited · Disclosed May 26, 2026 · python · markdown · web · networkPoC

External references

References

MITRE CVEcve.org · CVE-2026-47668 NVDnvd.nist.gov/vuln/detail/CVE-2026-47668 MITRE CWE · CWE-94Improper Control of Generation of Code ('Code…github.comgithub.com/dbgate/dbgate/releases/tag/v7.1.9 github.comgithub.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc github.comgithub.com/runZeroInc/nuclei-templates/blob/main/http/vulnerabilities/dbgate-unauth-rce.yaml

Activity feed

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

nuclei templates pull requestsNews · Nov 2, 2026Add CVE-2026-47668 - DbGate <= 7.1.8 Unauthenticated Remote Code Execution by Ayham970 · Pull Request #17648 · projectdiscovery/nuclei-templatesA functionName injection vulnerability in DbGate's JSON script runner permits remote code execution. In the default Anonymous authentication mode, an attacker can obtain a token without credentials through POST /auth/login and invoke the vulnerable runner endpoint. The content reports successful root-level execution on version 7.1.8 and describes a Nuclei exploit template. This validation does not establish exploitation in the wild.Read more ↗cvefeed high severityNews · Jul 23, 2026CVE-2026-47668 - DbGate: Unauthenticated Remote Code Execution via JSON Script RunnerA remote code execution vulnerability in DbGate's JSON script runner affecting versions prior to 7.1.9, caused by code injection through the `functionName` parameter that is concatenated into generated JavaScript and executed in a Node.js child process.Read more ↗nuclei templates pull requestsNews · May 20, 2026Add CVE-2026-47668 - DbGate RCE by benharvey-sage · Pull Request #16221 · projectdiscovery/nuclei-templates · GitHubThe content only references updates to a YAML file for CVE-2026-47668 and does not describe the underlying vulnerability or its significance.Read more ↗

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity12Community discussion across Reddit, Mastodon, and other social sources.