CVE-2026-47670
DbGate database manager versions 7.1.8 and earlier allow authenticated users to run arbitrary operating‑system commands as root. The flaw is triggered by an unsanitized functionName parameter in the /runners/load-reader endpoint. A patch is available in version 7.1.9.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of DbGate database manager, specifically those running version 7.1.8 or earlier, such as database administrators and developers who rely on DbGate for cross‑platform database management.
Real-world impact
An attacker who can log in to DbGate can execute any command on the host with root privileges, potentially taking full control of the system.
Why this severity
The CVSS score of 9.4 reflects the combination of authentication, high privileges, and the ability to execute arbitrary code with full system access. The vulnerability is critical because it requires only valid credentials and grants root‑level command execution.
What to do about it
- 01Upgrade DbGate to version 7.1.9 or later.
- 02Restart the DbGate service or application.
NVD-referenced vendor advisory
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 8d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 28, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.