Brief · Builders

Your approval prompt doesn't run when nobody's watching.

By alkizz · Oct 25, 2026

Lasso Security researchers Noy Pearl, Michael Sromin and Ophir Dror found six CVEs across five open-source agent platforms: DB-GPT, Langchain-Chatchat, EvoScientist, LangAlpha and OpenSRE. VulnCheck assigned the IDs, and the records went up Oct 19. Five of the six end the same way: a shell or code tool runs and nobody said yes. The sixth is DB-GPT shipping a hardcoded MySQL root password. In the five, either the endpoint has no authentication at all, or the project has an approval gate the shell tool never goes through: EvoScientist's async sub-agents skip it, and LangAlpha's and OpenSRE's shell tools were never wired into it, scheduled and headless runs included. Lasso's database marks all six "Known exploit: No," and none is in CISA KEV (catalog 2026.10.23, checked Oct 25). Only EvoScientist shows a fix.

The six

DB-GPT CVE-2026-77932, through 0.8.2: the /api/v1/chat/react-agent endpoint's auth function is a mock that returns an admin user for every request. Per Lasso, the agent's code_interpreter runs model-written Python as a plain subprocess, and shell_interpreter runs bash while bypassing the project's own sandbox opt-in guard. Root in the webserver container. No fixed version listed.
DB-GPT CVE-2026-77933, through 0.8.2: the shipped docker-compose.yml hardcodes the MySQL root password, publishes 3306 to the host, and connects the app as root. Lasso names the password, aa123456; if that string is in your compose file or .env, you're running the default. No fixed version listed.
Langchain-Chatchat CVE-2026-75128, through 0.3.1.3: POST /tools/call invokes any registered tool by name with no authentication, and an always-registered shell tool is one of them. Per Lasso, the API binds 0.0.0.0:7861 by default, the shipped compose file uses host networking, and the shipped image runs as root. No fixed version listed.
EvoScientist CVE-2026-77930, 0.1.0 before 0.2.5: async sub-agents such as the scheduler were built without the interrupt_on approval gate, so the framework handed them a host execute tool anyway. Per Lasso, the only guard was a seven-command denylist. Fixed in 0.2.5.
LangAlpha CVE-2026-109440, through 2026.09.07: Bash and ExecuteCode are always bound with no allow-list and no human-in-the-loop approval, on the same agent that fetches web pages. Per Lasso, scheduled automations run that same agent with no user present, and the sandbox's vault secrets are protected only by a natural-language prompt. No fixed version listed.
OpenSRE CVE-2026-109444, through 0.1.2026.10.19: shell_run never opts into the approval gate, and the headless presenter's execution_allowed() returns True unconditionally. Per Lasso, that presenter is installed for gateway, scheduled and embedded runs, and the injection vector it tested was a forwarded Grafana alert. No fixed version listed.

Two ways in

No lock on the door. DB-GPT and Langchain-Chatchat just answer whoever connects. Lasso's Chatchat proof of concept is one curl with no model and no GPU involved, and the command runs before the response is serialized, so the server returns HTTP 500 even when the attack worked. DB-GPT needs the model to cooperate: in Lasso's runs, llama3.1:8b and qwen3:8b emitted the tool call, while mistral:7b fumbled the tool-call format. Lasso is clear that this was formatting, "not a safety refusal." Your model's competence is not a security control.

A lock on a different door. EvoScientist, LangAlpha and OpenSRE each have an approval gate, just not on the shell. EvoScientist's main agent asks; its async sub-agents never do. LangAlpha's gate covers plan submission, not Bash or ExecuteCode. OpenSRE's shell_run never opts in, and its headless presenter approves everything on gateway and scheduled runs. Schedules and headless runs mean nobody is there to notice. Text the agent reads (a web page, a filing, an alert) becomes the instruction. In Lasso's OpenSRE tests, a local qwen3:14b emitted 14 shell_run calls across two runs, and all of them ran with no approval. Commands observed during testing included kubectl config changes and sudo systemctl restart. Lasso also says the injected command was saved into OpenSRE's cross-session memory under ~/.opensre/memory/; whether it re-runs later was unconfirmed.

Scores and fixes, checked

The scores depend on who you ask. VulnCheck, as the CNA, gives CVSS 3.1 9.8 to five of the six and 8.8 to LangAlpha in the CVE records. Its CVSS 4.0 scores are 9.3 for those five; for LangAlpha the CVE record says 8.7 and VulnCheck's own advisory page says 8.6 for the same vector. The CNA record is the one to quote, and 8.7 is what the CVSS 4.0 calculator gives for that vector. Lasso's pages list 9.8 for five and 8.8 for LangAlpha. ThreatFrontier reports different Lasso figures (9.9, 9.6 and 9.0 for EvoScientist, LangAlpha and OpenSRE); the Lasso pages I read don't show those. Call it critical-to-high and move on.

EvoScientist's fix came before the CVE. Issue #387 was closed by the "unified HITL approval for sync + async sub-agents" change, shipped in 0.2.5 on Aug 1. Read the release notes before you call it done, though: sync sub-agents now prompt, but the async writing and data-analysis agents get a backend guard that refuses "pipe-into-interpreter" commands rather than an approval prompt. That's a narrower fix than "approvals everywhere."

For the other four, the CVE records list no fixed version. DB-GPT's newest release is still 0.8.2, the affected version. Langchain-Chatchat's newest tagged release is v0.3.1, from July 2024. LangAlpha's newest tag is still v2026.09.07, the affected version. OpenSRE ships releases almost daily; the changelogs from 0.1.2026.10.20 through 0.1.2026.10.25 that I read don't mention shell_run or approvals. A quiet changelog isn't proof of no fix, so check the repo before you trust a new version.

My take: a 3, not a 4. Nobody is exploiting these yet, and you have to run one of five fairly niche tools. But if you run Chatchat or DB-GPT on a home-lab box with the shipped compose file, assume anyone on that network can run commands as root on it today. No fixed version is listed, so for now the fix is your network config.

What to do:

If you run Langchain-Chatchat, do this today. It has no fixed version, and per Lasso its API listens on 0.0.0.0:7861 by default, with an always-registered shell tool anyone can call without logging in. Take it off the network or put authentication in front of it now, not at your next patch window.
Get the endpoint off the network or behind auth. Bind to 127.0.0.1, or reach it over a VPN or through a reverse proxy that enforces login. Don't port-forward any of these to the internet.
DB-GPT: change the MySQL root password, stop publishing 3306, and give the app a non-superuser database role. Those are Lasso's own fixes.
Test your approvals on every path, not just the chat window. Run a harmless canary like id (what Lasso used) through a scheduled job, a background task, a sub-agent and any headless or gateway mode, and see whether you get asked. If nothing asks, assume nothing will. Don't run EvoScientist's --auto-approve behind channels you don't control.
Update where fixes exist. EvoScientist 0.2.5 or later (the current release is 0.3.8). For the other four, there's no fixed version in the records; keep them isolated and watch the repos.
Treat what the agent reads as input from strangers. Web pages, filings, alerts and chat messages can all carry instructions. Give the agent scoped, low-limit keys rather than your real cloud or production credentials.
Incident response, if one of these was reachable from anywhere but your own machine:
- Preserve reverse-proxy, container and agent logs before you restart or rebuild anything.
- Search for unauthenticated calls to POST /tools/call (Chatchat) and /api/v1/chat/react-agent (DB-GPT) from any address that isn't yours. Don't treat Chatchat's HTTP 500s as failures; per Lasso, the command runs first.
- Look for unexpected commands spawned by the agent process: id, whoami, curl, kubectl, sudo, new files in /tmp, and outbound connections you didn't make. On DB-GPT, check MySQL for root logins from unexpected hosts.
- On OpenSRE, review ~/.opensre/memory/ for entries you didn't write.
- If anything turns up, rotate every secret in the agent's environment: model API keys, database URLs, Slack, Grafana and cloud credentials, and LangAlpha vault secrets. Then rebuild the container instead of cleaning it.

Sources

← All briefs

Your approval prompt doesn't run when nobody's watching.

The six

Two ways in

Scores and fixes, checked

Sources

Related

On the checklist

More briefs