Aix-DB 1.2.4 RCE via ChatBI deepagents execute (auth non-admin)
CVE-2026-77926 Published on October 20, 2026
Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
Vulnerability Analysis
CVE-2026-77926 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Exposed Dangerous Method or Function
The software provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
Affected Versions
apconw Aix-DB:- Version 1.2.4, <= 1.2.4 is affected.