Unauthenticated Remote Code Execution in FastGPT agent-sandbox (CVE-2026-42302)

The agent-sandbox component of FastGPT initializes code-server with authentication disabled (--auth none) and binds to all network interfaces (0.0.0.0:8080), allowing any network-accessible user to gain unauthenticated access to a full web-based IDE. An attacker who can reach the exposed port can execute arbitrary commands within the sandbox container, access sensitive environment variables and API keys, and potentially pivot to other services on the same internal network. Affected versions: - 4.14.10～4.14.12 We recommend updating to: 4.14.13. CVSS 9.8 · our assessment: act_now Reference: https://github.com/labring/FastGPT/security/advisories/GHSA-34rc-438g-7w78 Details: https://vuln.today/cve/CVE-2026-42302