EUVD-2026-23557Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionGitHub Advisory
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object (e.g., {"$ne": ""}) as the password field. This NoSQL injection bypasses the password check, enabling login as any user including the root administrator. This issue has been fixed in version 4.14.9.5.
AnalysisAI
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login controls and access any account, including root administrator, by submitting MongoDB query operators instead of plaintext passwords. The vulnerability stems from missing runtime validation on password fields in the login endpoint. Exploitation requires no special conditions beyond network access to the login endpoint. CVSS 9.8 (Critical) with EPSS data unavailable; no CISA KEV listing or public POC identified at time of analysis, though GitHub security advisory provides technical details that could enable exploit development.
Technical ContextAI
FastGPT is an open-source AI Agent building platform maintained by Labring. The vulnerability (CWE-943: Improper Neutralization of Special Elements in Data Query Logic) occurs in the password-based authentication mechanism. TypeScript's type system provides compile-time type checking but does not enforce runtime validation. The application accepts user-supplied password input as a TypeScript string type but passes it directly to MongoDB queries without sanitizing or validating the actual runtime value. MongoDB's query operators like '$ne' (not equal), '$gt' (greater than), or '$regex' can be injected as JSON objects in place of expected string values. When the password field contains {"$ne": ""}, the resulting MongoDB query becomes 'password: {$ne: ""}' which evaluates to true for any non-empty password hash in the database, completely bypassing credential verification. This is a classic NoSQL injection pattern where the database query logic itself is manipulated rather than exploiting SQL syntax vulnerabilities.
RemediationAI
Upgrade immediately to FastGPT version 4.14.9.5 or later, available at https://github.com/labring/FastGPT/releases/tag/v4.14.9.5. The fix implemented in commit bd966d479fbe414d02679cf79f9eaaab3d100a2d adds runtime validation to ensure password fields contain only string primitives before database queries execute. For organizations unable to patch immediately, implement compensating controls: restrict network access to the login endpoint (/api/auth/login or equivalent) to trusted IP ranges only via firewall rules or reverse proxy ACLs - this reduces attack surface but does not eliminate risk from insider threats or compromised trusted networks. Deploy web application firewall (WAF) rules to block HTTP requests containing MongoDB operators like '$ne', '$gt', '$regex' in JSON bodies, though sophisticated attackers may bypass signature-based detection. Monitor authentication logs for unusual patterns like multiple successful logins from single source IPs across different user accounts, or logins without corresponding password change events. These mitigations provide only partial protection; version upgrade remains the definitive remediation.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Server-side request forgery in FastGPT (labring) versions 4.14.11 and prior lets a low-privileged user coerce the server
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attack
Cross-tenant data disclosure in FastGPT 4.14.17 through 4.15.0-beta5 lets a low-privileged tenant user read another tena
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today