High 8.8Published Oct 20, 2026

CVE-2026-77926Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool

Updated under an hour ago (2026-10-21 05:40 UTC)

Does this affect you?

It affects apconw Aix-DB. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for apconw Aix-DB

Exploited in the last 30 days

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-749
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 20, 2026
First seen by InfoSec Signals: Oct 20, 2026

Affected products

Affected products

apconw Aix-DB apconw:aix_db (from the name)	from 1.2.4 through 1.2.4	CNA record

References

https://www.lasso.security/vulnerability-database/cve-2026-77926technical-description, exploit
https://github.com/apconw/Aix-DB/blob/5d370adf3e695fc8b11137e5beeb01973cb46810/agent/common/enhanced_common_agent.py#L237technical-description
https://www.vulncheck.com/advisories/aix-db-1.2.4-authenticated-rce-via-chatbi-common-agent-execute-toolthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.