What happened
Lasso Security researchers found six vulnerabilities in five open-source AI agent platforms (DB-GPT, Langchain-Chatchat, EvoScientist, LangAlpha and OpenSRE), and VulnCheck published advisories for them on October 19, 2026, rating the DB-GPT, Chatchat and OpenSRE flaws critical. In DB-GPT up to 0.8.2 and Langchain-Chatchat up to 0.3.1.3, anyone who can reach the API can make the agent run shell commands as root with no login, while in the other three, text planted in web pages, alerts or chat messages can reach shell tools through paths that skip the approval step. ThreatFrontier's October 24 roundup says only EvoScientist (0.2.5) has a fix so far; it also lists a hard-coded MySQL root password in DB-GPT's shipped Docker setup as a separate CVE. (ThreatFrontier, Oct. 24, 2026)
Note on figures: VulnCheck rates the DB-GPT, Chatchat and OpenSRE flaws 9.3 (CVSS 4.0); Lasso's own page rates the Chatchat flaw 9.8. The count of fixed products comes from ThreatFrontier's review of advisory and release pages on October 24.
What it means for Canada: our assessment
No Canadian victims have been reported. Canadian exposure is an assessment: Canadian teams that self-host DB-GPT or Langchain-Chatchat for internal data chat or document Q&A, or run OpenSRE or LangAlpha agents for operations or market research, are exposed if those instances are reachable from an untrusted network or read outside content.
- Sectors
- AI startups and software firms · Bank, insurer and wealth-management data and research teams · Universities and research labs · Managed IT and SRE teams · Government and public-sector innovation labs
- Tools involved
- DB-GPT 0.8.2 and earlier (CVE-2026-77932, plus CVE-2026-77933 default MySQL root password) · Langchain-Chatchat 0.3.1.3 and earlier (CVE-2026-75128) · EvoScientist 0.1.0 to before 0.2.5 (CVE-2026-77930) · LangAlpha through 2026.09.07 (CVE-2026-109440) · OpenSRE through 0.1.2026.10.19 (CVE-2026-109444)
- Canadian rules
- PIPEDA: if an exposed instance held customer personal information, assess for a real risk of significant harm and report to the Privacy Commissioner and affected people
Quebec Law 25: record the confidentiality incident and notify the CAI if there is a risk of serious injury
OSFI B-13: federally regulated financial institutions must manage technology and open-source software risk, including self-hosted AI tools
OSFI E-23: AI agents used in FRFI processes fall under model risk management, which covers how agents use tools
Cyber Centre joint guidance on careful adoption of agentic AI: limit agent permissions and require human approval for high-impact actions
Assessment, not documented exposure. The sources don't name any Canadian organization. Canadian firms are exposed because these are popular self-hostable open-source projects, Langchain-Chatchat listens on all network interfaces (port 7861) by default and runs as root in its shipped image, and Canadian data and research teams commonly self-host such tools to keep data in Canada.
Takeaways for Canadian businesses
- BusinessInventory any DB-GPT, Langchain-Chatchat, OpenSRE or LangAlpha instances and take them off any untrusted network or put authentication in front of them; for Chatchat, bind the API to 127.0.0.1 instead of 0.0.0.0:7861, as Lasso recommends.
- BusinessUpgrade EvoScientist to 0.2.5 or later and stop running EvoSci serve --auto-approve on messaging channels you don't control.
- BusinessFor DB-GPT, change the MySQL root password from the shipped default, stop publishing port 3306, and connect the web server with a non-superuser database role.
- BusinessOn any instance that was reachable, rotate every secret in its environment (model API keys, database URLs, Slack, Grafana, Datadog and cloud credentials) and treat it as compromised.
- BusinessIf you find signs of exploitation, report it to the Canadian Centre for Cyber Security through My Cyber Portal or contact@cyber.gc.ca, and assess PIPEDA or Law 25 breach-reporting duties if personal information was on the host.
For the Canadian AI sector
Canadian teams that self-host open-source agents to keep data sovereign take on the vendor's job of securing them. These bugs show the risky part is often the plumbing around the model (unauthenticated APIs, scheduler and sub-agent paths) rather than the model itself, so approval gates have to cover every way an agent can run.
Written by AgentsNorth from the source below. General information, not legal or security advice.