PT-2026-7419 · Fastgpt · Fastgpt

Jingfelix · Publicado 2026-02-10 · Atualizado 2026-02-10 · CVE-2026-26003

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.0 through 4.14.5

Description FastGPT, an AI Agent building platform, has an issue where the plugin system can be accessed directly through the API endpoint /api/plugin/xxx without authentication. This affects versions 4.14.0 to 4.14.5 and could lead to the plugin system crashing and the loss of plugin installation status. Older versions are considered to have a negligible impact as they only offer information-gathering interfaces. The issue does not result in key leakage.

Recommendations Versions prior to 4.14.5-fix are affected.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-26003

GHSA-WCRG-G824-9GFG

Produtos afetados

Fastgpt

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26003.json · Exploit
• https://github.com/labring/FastGPT/security/advisories/GHSA-wcrg-g824-9gfg · Aviso do Fabricante
• https://github.com/labring/FastGPT/commit/0beb52a2f3dc4067aab011cc98122d1352823b0c · Correção
• https://github.com/labring/FastGPT/releases/tag/v4.14.5-fix · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26003 · Nota de Segurança
• https://t.me/CVEtracker/44320 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2021360192022098153 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26003 · Aviso do Fabricante