Vulnerabilities

TI-2026-29127 CVE-2026-40352

FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover

HIGH 73

FastGPT is an AI Agent building platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0038 Published 2026-04-17 Fixed in 4.14.9.5 CWE-943

TI-2026-29126 CVE-2026-40351

FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

HIGH 82

FastGPT is an AI Agent building platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00627 Published 2026-04-17 Fixed in 4.14.9.5 CWE-943

TI-2026-29046 CVE-2026-40252

Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT

LOW 24

FastGPT is an AI Agent building platform.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00348 Published 2026-04-10 Fixed in 4.14.10.4 CWE-284

TI-2026-28927 CVE-2026-40100

FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default

LOW 30

FastGPT is an AI Agent building platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00258 Published 2026-04-10 Fixed in 4.14.10.3 CWE-918

TI-2026-26462 CVE-2026-34162

FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft

HIGH 82

FastGPT is an AI Agent building platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00423 Published 2026-03-31 Fixed in 4.14.9.5 CWE-306

TI-2026-26463 CVE-2026-34163

Server-Side Request Forgery via MCP Tools Endpoint in FastGPT

HIGH 67

FastGPT is an AI Agent building platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00288 Published 2026-03-31 Fixed in 4.14.9.5 CWE-918

TI-2026-25517 CVE-2026-33075

FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml

MEDIUM 48

FastGPT is an AI Agent building platform.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00309 Published 2026-03-20 No fix listed CWE-494

TI-2026-24665 CVE-2026-32128

FastGPT Python Sandbox Bypass of File-Write Restriction

MEDIUM 61

FastGPT is an AI Agent building platform.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00347 Published 2026-03-11 No fix listed CWE-184

TI-2026-21079 CVE-2026-26075

Cross-Site Request Forgery (CSRF) in FastGPT

LOW 35

FastGPT is an AI Agent building platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00123 Published 2026-02-12 Fixed in 4.14.7 CWE-352

TI-2026-21017 CVE-2026-26003

FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack

LOW 36

FastGPT is an AI Agent building platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0027 Published 2026-02-10 Fixed in 4.14.5-fix CWE-601

TI-2025-38827 CVE-2025-62612

FastGPT File Reading Node SSRF Vulnerability

LOW 36

FastGPT is an AI Agent building platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00238 Published 2025-10-22 Fixed in 4.11.1 CWE-918

TI-2025-32647 CVE-2025-52552

FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS

MEDIUM 58

FastGPT is an AI Agent building platform.

CVSS 4.0MEDIUM 5.5 Network No auth User interaction EPSS 0.00266 Published 2025-06-21 Fixed in 4.9.12 CWE-601

TI-2025-31211 CVE-2025-49131

FastGPT Sandbox Vulnerable to Sandbox Bypass

HIGH 76

FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00489 Published 2025-06-09 Fixed in 4.9.11 CWE-732

TI-2025-20410 CVE-2025-27600

FastGPT SSRF

LOW 36

FastGPT is a knowledge-based platform built on the LLMs.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00274 Published 2025-03-06 Fixed in 4.9.0 CWE-918

Vulnerabilities

Filters