CVE-2024-10835 is a critical flaw (CVSS 9.8) in eosphoros-ai DB-GPT v0.6.0. The web API POST /api/v1/editor/sql/run runs arbitrary SQL with no access control, and DuckDB SQL can write arbitrary files, which may lead to remote code execution. No fix is confirmed, so keep DB-GPT off untrusted networks.
What's affected
The CVE record lists eosphoros-ai/db-gpt version v0.6.0. The description says the API at /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control, and that this can be used to write arbitrary files to the file system through DuckDB SQL, potentially leading to remote code execution. The reference is a huntr bounty page that I could not read.
I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release. The same version has two related records, CVE-2024-10901 and CVE-2024-10902.
How to check if you're exposed
Find the version of DB-GPT you run, from the container tag or the project files. v0.6.0 is the version named in the record.
Then look at how the web server is exposed. DB-GPT is designed to talk to databases and run queries for you, so its API is powerful by design. Check whether the API port answers from networks other than the one your team uses. A request to the endpoint from an unauthenticated client tells you whether access control exists in your setup.
Check the file system permissions of the account that runs it. If it can write to application or Python directories, an arbitrary file write is much more serious.
What to do now
- Find all DB-GPT deployments and their versions.
- Check the project for a release newer than v0.6.0 and read its notes for authentication changes.
- Put the service behind an authenticating reverse proxy or a VPN, and do not publish it to the internet.
- Run it as an unprivileged user with write access only to its data directory.
- Review the file system for unexpected files, particularly in Python package directories.
Why it matters
Here two problems meet. The first is missing access control on a powerful function, so anyone who can reach the API can ask for queries. The second is that the SQL engine, DuckDB, can write files, which turns a query into a file write. The record lists SQL injection (CWE-89) as its weakness class, though the description reads more like an unauthenticated query interface than classic injection.
Arbitrary file write often leads to code execution, since writing a file that the application later loads or runs is a common route. The description for the sibling entries names writing a file such as init.py into the site-packages directory as an example. The CVE is not on the CISA Known Exploited Vulnerabilities list. Tools that give AI agents database access should be treated as privileged internal services.
Quick check
Is this classic SQL injection?
The weakness is tagged that way, but the description is about an API that runs any SQL it receives without access control.
What is the safest short term step?
Do not expose DB-GPT to untrusted networks, and add authentication in front of it.
Sources
Last reviewed: 19 October 2026.
