CVE-2026-47668
DbGate, a cross‑platform database manager, has a critical flaw that lets attackers run arbitrary code on the server by sending a specially crafted JSON script. The vulnerability exists in versions 7.1.8 and earlier and is fixed in 7.1.9. It can be exploited remotely without authentication.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
DbGate database manager, versions 7.1.8 and earlier.
Real-world impact
An attacker who can send a malicious JSON script to the /runners/start endpoint can execute arbitrary JavaScript code on the host machine, potentially taking full control of the server, accessing or modifying data, and installing malware.
Why this severity
The CVSS score of 10 reflects that the flaw allows remote code execution with no authentication or user interaction, giving an attacker complete control over the affected system.
What to do about it
- 01Upgrade DbGate to version 7.1.9 or later.
- 02Restart the DbGate service after the upgrade.
NVD-referenced vendor advisory
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 9d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.