CVE-2026-123019

DB-GPT model registration can enable execution of repository code

eosphoros-ai · DB-GPT Hugging Face model adapter

First documented disclosure · Review checkpoint

Summary

A model registered on an exposed deployment can cause Python from its repository to run during loading.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The original report describes local controlled execution. No malicious deployment or production compromise was established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The Hugging Face adapter defaults to trusting remote code. A custom model repository can supply Python that the loader imports.

Conditions required

An attacker can register and trigger loading of an untrusted model. The reported default configuration exposed registration without authentication.

Potential impact

The model’s Python can run with the service account’s permissions before inference begins.

Affected versions and configurations

VulDB lists versions through 0.8.2. The researcher tested 0.8.1. The tagged 0.8.2 adapter retains a true default.

Fix and mitigation status

No issue-specific fixed release was verified.

Practical next steps

Limit registration to authenticated administrators, disable remote code by default and review immutable model revisions before loading them.

Operating lesson

Approve executable model code separately from model weights.

Evidence and limits

The November 5 CVE refers to the October 14 model-loading disclosure. It is separate from DB-GPT’s generated-code runner.

Sources