DbGate unauthenticated RCE (CVE-2026-47668) [PoC]
CVE-2026-47668
CVE-2026-47668: DbGate 7.1.8 and prior RCE via code injection without authentication (CVSS 10.0). Patch to 7.1.9 or disable the JSON script runner.
Exploitation confirmed - public proof-of-concept - CVE-2026-47668 is a critical remote code execution vulnerability in DbGate 7.1.8 and prior that grants unauthenticated attackers the ability to execute arbitrary commands on the server. Patched in version 7.1.9 - update immediately.
Overview
CVE-2026-47668 affects DbGate, a popular cross-platform database manager. The vulnerability resides in the JSON script runner endpoint (POST /runners/start). When processing JSON script assign commands, the functionName parameter is concatenated directly into dynamically generated JavaScript source code without sanitization. This generated code is then executed in a forked Node.js child process, allowing an unauthenticated remote attacker to inject arbitrary JavaScript and achieve full remote code execution on the underlying operating system.
The vulnerability carries a CVSS score of 10.0 (Critical) due to its network-based attack vector, low attack complexity, and the lack of required privileges or user interaction.
Impact
An attacker exploiting CVE-2026-47668 can execute arbitrary code with the privileges of the DbGate server process. This typically equates to full control over the database manager’s host system, including access to all managed databases, files on the server, and lateral movement opportunities within the network. No authentication is required; the only prerequisite is network access to the vulnerable POST /runners/start endpoint.
Remediation
DbGate has released version 7.1.9 which patches this vulnerability by properly sanitizing the functionName parameter before code execution. All users running version 7.1.8 or earlier should upgrade to 7.1.9 immediately. If immediate patching is not possible, consider disabling the JSON script runner or restricting network access to the /runners/start endpoint to trusted IP addresses only until the update can be applied.
Security Insight
This vulnerability underscores a recurring pattern in Node.js applications where string concatenation for code generation remains a common but dangerous practice. Developers should treat any endpoint that dynamically generates and executes JavaScript from user-supplied input as an automatic code execution vector, regardless of the context. DbGate’s response with a prompt patch in 7.1.9 is commendable, but the root cause—direct string interpolation into executable code—is a design pattern that should be avoided entirely in security-critical applications. For ongoing coverage of similar vulnerabilities, see our latest security news.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Am I Affected by CVE-2026-47668?
Pick an ecosystem, paste your installed version, and we'll compare it against the fixed version published on OSV.dev. Browser-only — nothing is sent to a server.
Heuristic comparison only. Always cross-check against the vendor advisory before making patching decisions.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| Nxploited/CVE-2026-47668 DbGate Unauthenticated Remote Code Execution | ★ 6 |
Showing 1 of 1 known references. Source: nomi-sec/PoC-in-GitHub.
Nuclei Detection Templates
Detection template available — your exposure is being scanned
The templates below are YAML signatures for the Nuclei scanner from ProjectDiscovery. They are not exploit code — they are detection rules that confirm whether a target is vulnerable. The presence of a Nuclei template means every bug bounty hunter, AppSec team, red team, and reconnaissance pipeline on the public internet is actively probing for this CVE.
Assume your exposed instances have already been touched. Patch immediately even if no exploitation is observed yet — fingerprinting precedes exploitation by days at most.
| Template | Source |
|---|---|
CVE-2026-47668.yaml | View YAML |
1 Nuclei template indexed for this CVE. Source: projectdiscovery/nuclei-templates.
Related Advisories
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * ...
Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unes...
NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a...
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution....