Vulnerability in Fastgpt
CVE-2026-40352
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (31.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 31.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Fastgpt
- Labring Fastgpt — versions < 4.14.9.5
Weakness classification (CWE)
References
- github.com/labring/FastGPT/security/advisories/GHSA-422w-vrfj-72g6 (Exploit, Vendor Advisory)
- github.com/labring/FastGPT/commit/bd966d479fbe414d02679cf79f9eaaab3d100a2d (Patch)
- github.com/labring/FastGPT/releases/tag/v4.14.9.5 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-40352?
- CVE-2026-40352 is a high-severity vulnerability in Fastgpt, classified under Improper Neutralization of Special Elements in Data Query Logic. CVSS score: 8.8/10. Published 2026-04-17.
- How severe is CVE-2026-40352?
- High severity. CVSS v3 base score is 8.8 out of 10.