CVE-2026-47668: DbGate Unauthenticated RCE via JSON Script Runner (CVSS 10.0)

Vulnerability Overview

CVE-2026-47668 is a critical-severity (CVSS 10.0) unauthenticated remote code execution vulnerability in dbgate-serve, the server component of the DbGate database management tool distributed via npm. The root cause is a combination of improper input validation (CWE-20), code injection (CWE-94), and insecure default initialization (CWE-1188): the JSON Script Runner endpoint accepts arbitrary JavaScript payloads and executes them server-side without any authentication check. An unauthenticated remote attacker with network access to a running dbgate-serve instance can achieve full server compromise — arbitrary command execution under the process's runtime identity.

Affected Software

• Package: dbgate-serve (npm)
• Affected versions: <= 7.1.8
• Vendor: npm ecosystem (DbGate project)

At the time of writing, no patched version has been published. Instances exposed to untrusted networks should be isolated or taken offline until an upstream fix is available.

Exploitation Status

A public proof-of-concept is available. This significantly lowers the barrier to exploitation — opportunistic attackers can weaponize this vulnerability without specialized knowledge. DbGate is commonly deployed in internal developer and DBA environments, but instances exposed to the internet (or reachable via lateral movement on a flat network) are at immediate risk. The absence of a patch as of disclosure date means the window of exposure is open-ended. Treat any reachable dbgate-serve endpoint as a critical priority for isolation.

Detection Coverage

Our detection ships query logic across seven SIEM platforms, covering both network-layer and host-layer telemetry:

• Microsoft Sentinel (KQL) — correlates HTTP requests targeting the Script Runner endpoint with anomalous process spawning events on the host, flagging unauthenticated call chains that result in child process execution.
• Splunk (SPL) — hunts web access logs for requests to the vulnerable endpoint combined with downstream process or network activity indicative of successful code execution.
• Elastic (EQL) — uses sequence detection to link inbound HTTP events to subsequent suspicious process tree activity within a tight time window.
• QRadar (AQL) — queries flow and event data for Script Runner endpoint hits from external or unexpected source IPs.
• Sumo Logic — log search rules targeting the endpoint path combined with payload size anomalies consistent with JSON script injection.
• Chronicle (YARA-L) — rule matches on the characteristic request pattern and correlates with UDM process events for post-exploitation indicators.
• CrowdStrike (CQL) — EDR-side detection of process injection and command execution originating from the dbgate-serve process tree.

The detection logic focuses on three signals: unauthenticated requests to the Script Runner endpoint, anomalous child processes spawned by the DbGate server process, and outbound network connections initiated immediately after a Script Runner invocation — a pattern consistent with reverse shell or exfiltration activity.

Recommended Response

• Immediately audit your environment for exposed dbgate-serve instances (check ports 3000/6006 or custom bind addresses).
• Block external access to the DbGate server port at the network perimeter or host firewall until a patch is available.
• Review process execution logs on hosts running DbGate for unexpected child processes spawned under the dbgate-serve parent.
• Monitor for outbound connections from DbGate server hosts to unexpected destinations.

Full detection queries for all seven SIEM platforms — including tuning guidance and triage notes — are available on the CVE-2026-47668 detection page.