CVE-2026-51866Published
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-51866 · Microsoft / collected KEV context
cve-program · CVE-2026-51866
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.