CVE-2026-3409: DB-GPT Flow Import RCE Vulnerability

CVE-2026-3409 Overview

A code injection vulnerability has been discovered in eosphoros-ai DB-GPT version 0.7.5. The vulnerability exists in the Flow Import Endpoint component, specifically affecting the function importlib.machinery.SourceFileLoader.exec_module within the file /api/v1/serve/awel/flow/import. An attacker can exploit this flaw by manipulating file inputs to inject and execute arbitrary code on the target system. The attack can be initiated remotely without requiring authentication, making it particularly concerning for exposed DB-GPT deployments.

Critical Impact

Remote attackers can leverage this code injection vulnerability to execute arbitrary code on DB-GPT servers, potentially leading to complete system compromise, data theft, or lateral movement within the network.

Affected Products

• eosphoros-ai DB-GPT version 0.7.5
• DB-GPT Flow Import Endpoint (/api/v1/serve/awel/flow/import)
• Systems utilizing the AWEL (Agentic Workflow Expression Language) flow import functionality

Discovery Timeline

• 2026-03-02 - CVE-2026-3409 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-3409

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection). The flaw resides in how DB-GPT handles imported flow files through its AWEL workflow system. The application uses Python's importlib.machinery.SourceFileLoader.exec_module function to dynamically load and execute code from imported flow configuration files without proper validation or sanitization.

The network-accessible nature of this vulnerability allows remote attackers to target exposed DB-GPT instances. The attack requires no authentication or user interaction, and can be executed with low complexity. While the impact to confidentiality, integrity, and availability is categorized as limited, successful exploitation could serve as an initial foothold for more sophisticated attacks.

The vendor was contacted regarding this vulnerability but did not respond, leaving users without an official patch or mitigation guidance.

Root Cause

The root cause of this vulnerability lies in the unsafe use of Python's dynamic module loading capabilities. The SourceFileLoader.exec_module function is designed to execute Python modules from file sources. When user-controlled file content is passed to this function without proper validation, attackers can inject malicious Python code that will be executed with the privileges of the DB-GPT application process.

The lack of input sanitization on the Flow Import Endpoint allows attackers to craft malicious flow definition files containing embedded Python code. When these files are processed by the import functionality, the injected code is executed by the underlying Python interpreter.

Attack Vector

The attack is initiated by sending a crafted HTTP request to the /api/v1/serve/awel/flow/import endpoint. The attacker constructs a malicious flow import file that contains injected Python code. When the DB-GPT server processes this import request, the exec_module function loads and executes the malicious payload.

The vulnerability mechanism involves manipulating the file parameter in the import request to include arbitrary Python code. Since the server-side import functionality does not adequately validate or sandbox the imported content, the injected code executes within the server's context. Technical details and a proof-of-concept demonstrating this attack vector are available in the GitHub Gist PoC Script.

Detection Methods for CVE-2026-3409

Indicators of Compromise

• Unusual HTTP POST requests to /api/v1/serve/awel/flow/import endpoint containing obfuscated or encoded content
• Unexpected child processes spawned by the DB-GPT application process
• Anomalous outbound network connections originating from the DB-GPT server
• Modified or newly created files in the DB-GPT installation directory or system directories

Detection Strategies

• Implement web application firewall (WAF) rules to inspect and block suspicious payloads targeting the flow import endpoint
• Monitor application logs for import requests with unusual file content patterns or base64-encoded strings
• Deploy endpoint detection and response (EDR) solutions to identify code execution anomalies in Python processes
• Establish baseline behavior for the DB-GPT application and alert on deviations

Monitoring Recommendations

• Enable detailed access logging for all API endpoints, particularly /api/v1/serve/awel/flow/import
• Configure intrusion detection systems (IDS) to flag requests containing Python-specific keywords or import statements in unexpected contexts
• Set up real-time alerting for any successful exploitation indicators such as reverse shell connections or unauthorized process execution
• Regularly review and audit flow import activities for unauthorized or suspicious entries

How to Mitigate CVE-2026-3409

Immediate Actions Required

• Restrict network access to the Flow Import Endpoint by implementing firewall rules or network segmentation
• Disable the flow import functionality if not actively required in your deployment
• Implement authentication and authorization controls on the /api/v1/serve/awel/flow/import endpoint
• Review existing imported flows for any signs of malicious content

Patch Information

As of the last update, the vendor (eosphoros-ai) has not responded to disclosure attempts and no official patch is available. Users should monitor the DB-GPT GitHub repository for security updates. Additional vulnerability details can be found at VulDB #348304.

Workarounds

• Deploy a reverse proxy or WAF in front of DB-GPT to filter and validate incoming requests to the flow import endpoint
• Run DB-GPT in a containerized or sandboxed environment to limit the impact of potential code execution
• Implement network-level access controls to ensure only trusted sources can reach the API endpoints
• Consider temporarily taking the flow import feature offline until an official patch is released

# Example: Restrict access to flow import endpoint using iptables
# Only allow access from trusted management network (adjust CIDR as needed)
iptables -A INPUT -p tcp --dport 5000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP

# Example: Nginx reverse proxy configuration to block flow import endpoint
# Add to your nginx server block configuration
location /api/v1/serve/awel/flow/import {
    deny all;
    return 403;
}