PT-2026-39205 · Fastgpt · Fastgpt

Jinyimeng01 · Published 2026-05-08 · Updated 2026-06-17 · CVE-2026-42302

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.10 through 4.14.12

Description The agent-sandbox component allows unauthenticated Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a remote machine. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces at '0.0.0.0:8080'. This configuration enables any user with network access to the port to bypass authentication and gain full control over the sandbox environment.

Recommendations Update to version 4.14.13.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-42302

Affected Products

Fastgpt

References · 10

• 🔥 https://github.com/labring/FastGPT/security/advisories/GHSA-34rc-438g-7w78 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42302 · Security Note
• https://github.com/labring/FastGPT/releases/tag/v4.14.13 · Note
• https://github.com/labring/FastGPT/pull/6781 · Note
• https://github.com/labring/FastGPT/commit/9d1cafce9241430fb5bcdd646455055c5f4ae0a4 · Note
• https://t.me/CVEtracker/53165 · Telegram Post
• https://twitter.com/lyrie_ai/status/2067091401989341526 · Twitter Post
• https://twitter.com/CVEnew/status/2053131425516548137 · Twitter Post
• https://twitter.com/lyrie_ai/status/2067091402924704078 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052952676623675778 · Twitter Post