What is the CVSS score of CVE-2026-33075?

CVE-2026-33075 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2026-33075?

Organizations using FastGPT face significant risk from CVE-2026-33075 rated CVSS 8.8.

How to fix or mitigate CVE-2026-33075?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Docker CVE-2026-33075

EUVD-2026-13645 HIGH

Download of Code Without Integrity Check (CWE-494)

2026-03-20 GitHub_M

RCE Docker

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 08:45 euvd

EUVD-2026-13645

Analysis Generated

Mar 20, 2026 - 08:45 vuln.today

CVE Published

Mar 20, 2026 - 08:37 nvd

HIGH 8.8

DescriptionGitHub Advisory

FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration by any external contributor. It uses pull_request_target (which runs with access to repository secrets) but checks out code from the pull request author's fork, then builds and pushes Docker images using attacker-controlled Dockerfiles. This also enables a supply chain attack via the production container registry. A patch was not available at the time of publication.

AnalysisAI

FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-image.yml GitHub Actions workflow that allows external contributors to execute malicious code and exfiltrate repository secrets. The vulnerability stems from unsafe use of pull_request_target with attacker-controlled Dockerfile builds that are pushed to the production container registry, enabling both direct compromise and supply chain attacks. No patch was available at the time of public disclosure, making this an unpatched remote code execution affecting the AI Agent building platform across affected versions.

Technical ContextAI

The vulnerability is rooted in CWE-494 (Download of Code Without Integrity Check) and represents a GitHub Actions workflow security misconfiguration. FastGPT (CPE: cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:*) uses the pull_request_target trigger event, which executes with full access to repository secrets and elevated permissions, but unsafely checks out code from a pull request author's fork rather than validating its integrity. The workflow then uses this untrusted source to build Docker images and push them to a production container registry without validation. This combines GitHub Actions secrets exposure with container image supply chain compromise, allowing attackers to inject arbitrary code into both the build process and the resulting container artifact.

RemediationAI

Immediately disable the fastgpt-preview-image.yml workflow or restrict pull_request_target events to prevent external contributor execution until a patch is released by the FastGPT maintainers. Contact labring/FastGPT via their security advisory channel at https://github.com/labring/FastGPT/security/advisories/GHSA-xfx8-w35j-485c to request an urgent patch. As an interim mitigation, switch the workflow trigger from pull_request_target to pull_request (which runs in a sandboxed context without secrets access) if the workflow's functionality permits, or implement mandatory code review and approval requirements for all pull requests before workflow execution. Regenerate and rotate all repository secrets and container registry credentials that may have been exposed. Audit the production container registry for any images built during the vulnerable period and remove or rebuild them after patching.