Endorlabs CVE-2026-47668: Unauthenticated RCE Vulnerability in DbGate
Article Content
- •CVE-2026-47668 allows unauthenticated remote code execution in DbGate.
- •The vulnerability is due to unsafe string interpolation in JavaScript code generation.
- •Default deployment settings may expose systems to exploitation without authentication.
DbGate's JSON script runner has a critical vulnerability (CVE-2026-47668) that allows unauthenticated remote code execution via the functionName parameter in JSON script assign commands. The vulnerability arises from direct string concatenation of user-controlled values into dynamically generated JavaScript code, which is executed in a forked Node.js child process. The flaw affects systems using the default deployment settings, where authentication is disabled, allowing attackers to exploit the vulnerability without credentials. If exploited, attackers gain full Node.js runtime access, including built-in modules. The CVSS score for this vulnerability is 10.0, indicating a critical risk. Organizations using DbGate are urged to review their deployment settings and implement necessary security measures. The vulnerability was disclosed on June 6, 2026, and is currently under active scrutiny.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-47668 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…