PT-2026-7419 · Fastgpt · Fastgpt

Jingfelix · Published 2026-02-10 · Updated 2026-02-10 · CVE-2026-26003

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.0 through 4.14.5

Description FastGPT, an AI Agent building platform, has an issue where the plugin system can be accessed directly through the API endpoint /api/plugin/xxx without authentication. This affects versions 4.14.0 to 4.14.5 and could lead to the plugin system crashing and the loss of plugin installation status. Older versions are considered to have a negligible impact as they only offer information-gathering interfaces. The issue does not result in key leakage.

Recommendations Versions prior to 4.14.5-fix are affected.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-26003

GHSA-WCRG-G824-9GFG

Affected Products

Fastgpt

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26003.json · Exploit
• https://github.com/labring/FastGPT/security/advisories/GHSA-wcrg-g824-9gfg · Vendor Advisory
• https://github.com/labring/FastGPT/commit/0beb52a2f3dc4067aab011cc98122d1352823b0c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26003 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26003 · Vendor Advisory
• https://github.com/labring/FastGPT/releases/tag/v4.14.5-fix · Note
• https://t.me/CVEtracker/44320 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021360192022098153 · Twitter Post