FastGPT
CVE-2026-42302
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Shipped default disables auth and binds to all interfaces, so a remote attacker needs no privileges or interaction (PR:N/UI:N/AC:L); full shell access yields total C/I/A within the sandbox.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution (RCE). The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080). This configuration allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment. This issue has been patched in version 4.14.13.
AnalysisAI
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent, unauthenticated attacker seize full control of the sandbox environment. The bundled entrypoint.sh launches code-server with --auth none and binds it to 0.0.0.0:8080, so reaching the exposed port grants an interactive VS Code-based shell with no password. CVSS is 9.8 and SSVC rates technical impact as total with automatable exploitation; publicly available exploit code exists (SSVC 'poc'), though EPSS remains modest at 0.33%.
Technical ContextAI
FastGPT is an open-source LLM/AI-agent building platform (vendor 'labring', per CPE cpe:2.3:a:labring:fastgpt). Its agent-sandbox feature runs user/agent code inside a container that embeds code-server - the browser-hosted build of Visual Studio Code, which provides a full terminal and filesystem within the container. The root cause is CWE-306 (Missing Authentication for a Critical Function): the container startup script explicitly passes '--auth none' (disabling code-server's password gate) and '--bind-addr 0.0.0.0:8080' (listening on every interface instead of loopback). The upstream fix (PR #6781, commit 9d1cafce) removes both flags, moves the internal target port to 44772, and introduces a server-side proxy (server.ts) that fetches a per-sandbox code-server password via an internal proxyCSPassword API and injects an authenticated 'code-server-session' cookie, so authentication is enforced through the FastGPT app rather than left off.
RemediationAI
Vendor-released patch: v4.14.13 - upgrade FastGPT (and rebuild/redeploy the agent-sandbox container image so the corrected entrypoint.sh ships) to 4.14.13 or later; see the advisory GHSA-34rc-438g-7w78, PR https://github.com/labring/FastGPT/pull/6781, and commit https://github.com/labring/FastGPT/commit/9d1cafce9241430fb5bcdd646455055c5f4ae0a4. If an immediate upgrade is not possible, the concrete compensating control is to prevent external reachability of the sandbox: block/firewall TCP port 8080 on the sandbox container so it is not exposed on 0.0.0.0, and restrict access to the FastGPT reverse proxy only - trade-off is that direct debugging access to the sandbox is lost. Alternatively, edit entrypoint.sh to bind code-server to 127.0.0.1 instead of 0.0.0.0 and remove '--auth none' (setting a code-server password), matching the upstream fix; the side effect is that any tooling expecting the unauthenticated 8080 endpoint must be reconfigured to authenticate. Do not rely on network obscurity alone, as SSVC marks exploitation automatable.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Server-side request forgery in FastGPT (labring) versions 4.14.11 and prior lets a low-privileged user coerce the server
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attack
Share
External POC / Exploit Code
Leaving vuln.today