FastGPT
CVE-2026-42302
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed sandbox port 8080
-
DeliveryConnect to code-server (no auth)
-
ExploitOpen built-in terminal
-
ExecutionExecute arbitrary commands in sandbox
-
ImpactFull container control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The sandbox's code-server port (0.0.0.0:8080) must be network-reachable by the attacker; no authentication, user interaction, or special privileges are required because the shipped entrypoint.sh runs code-server with '--auth none' by default in versions 4.14.10-4.14.12 (CVSS PR:N/UI:N/AC:L). The primary limiting factor is network exposure: if port 8080 is confined to the container or loopback by the deployment's firewall/network policy, an external attacker cannot reach it - so the realistic risk is highest for internet-exposed or flat-network deployments and lowest where the sandbox port is not routed beyond the host. |
| Impact | Signals are strongly aligned toward high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes remote, low-complexity, unauthenticated exploitation with total impact, and SSVC concurs: exploitation=poc, automatable=yes, technical impact=total. The confirmed source-code evidence (the flags are hard-coded in the shipped entrypoint.sh) means the vulnerable state is the default, not a rare misconfiguration, which reinforces the low attack complexity. The one tempering signal is EPSS at 0.33% (56th percentile) - low despite the critical CVSS - which reflects that FastGPT is a niche, self-hosted product with a smaller install base rather than any doubt about exploitability; it suggests limited mass-scanning volume, not low technical risk. There is no CISA KEV listing, so this is 'publicly available exploit code exists', not confirmed active exploitation. Net: genuinely critical wherever the sandbox port is network-reachable; real-world exposure hinges on whether port 8080 is reachable beyond the container/host boundary. |
| Exploit ScenarioDerived | An attacker who can reach the sandbox host on TCP 8080 - a co-tenant on the same network, a container escapee, or anyone on the internet if the port is exposed - simply browses to http://target:8080/ and lands in an authenticated-by-default code-server IDE. From the built-in terminal they run arbitrary commands inside the sandbox with no credentials. Because the misconfiguration is the shipped default and exploitation is automatable, mass scanning for open 8080 code-server instances is a realistic delivery method. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent, unauthenticated attacker seize full control of the sandbox environment. The bundled entrypoint.sh launches code-server with --auth none and binds it to 0.0.0.0:8080, so reaching the exposed port grants an interactive VS Code-based shell with no password. CVSS is 9.8 and SSVC rates technical impact as total with automatable exploitation; publicly available exploit code exists (SSVC 'poc'), though EPSS remains modest at 0.33%.
RemediationAI
Vendor-released patch: v4.14.13 - upgrade FastGPT (and rebuild/redeploy the agent-sandbox container image so the corrected entrypoint.sh ships) to 4.14.13 or later; see the advisory GHSA-34rc-438g-7w78, PR https://github.com/labring/FastGPT/pull/6781, and commit https://github.com/labring/FastGPT/commit/9d1cafce9241430fb5bcdd646455055c5f4ae0a4. If an immediate upgrade is not possible, the concrete compensating control is to prevent external reachability of the sandbox: block/firewall TCP port 8080 on the sandbox container so it is not exposed on 0.0.0.0, and restrict access to the FastGPT reverse proxy only - trade-off is that direct debugging access to the sandbox is lost. Alternatively, edit entrypoint.sh to bind code-server to 127.0.0.1 instead of 0.0.0.0 and remove '--auth none' (setting a code-server password), matching the upstream fix; the side effect is that any tooling expecting the unauthenticated 8080 endpoint must be reconfigured to authenticate. Do not rely on network obscurity alone, as SSVC marks exploitation automatable.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FastGPT is an open-source LLM/AI-agent building platform (vendor 'labring', per CPE cpe:2.3:a:labring:fastgpt). Its agent-sandbox feature runs user/agent code inside a container that embeds code-server - the browser-hosted build of Visual Studio Code, which provides a full terminal and filesystem within the container. The root cause is CWE-306 (Missing Authentication for a Critical Function): the container startup script explicitly passes '--auth none' (disabling code-server's password gate) and '--bind-addr 0.0.0.0:8080' (listening on every interface instead of loopback). The upstream fix (PR #6781, commit 9d1cafce) removes both flags, moves the internal target port to 44772, and introduces a server-side proxy (server.ts) that fetches a per-sandbox code-server password via an internal proxyCSPassword API and injects an authenticated 'code-server-session' cookie, so authentication is enforced through the FastGPT app rather than left off.
Know when Fastgpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Shipped default disables auth and binds to all interfaces, so a remote attacker needs no privileges or interaction (PR:N/UI:N/AC:L); full shell access yields total C/I/A within the sandbox.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution (RCE). The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080). This configuration allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment. This issue has been patched in version 4.14.13.
Executive ViewAI
FastGPT versions 4.14.10 through 4.14.12 contain an unauthenticated remote code execution vulnerability in the agent-sandbox component that allows attackers to gain full control of the sandbox environment via exposed port 8080. Organizations using affected versions face immediate risk of unauthorized code execution, data theft, and potential lateral movement into connected infrastructure. The threat is elevated by publicly available exploit code and the default insecure configuration (code-server launched with authentication disabled).
No vendor-released patch identified at time of analysis. Interim mitigations: (1) enforce firewall rules restricting port 8080 access to whitelisted trusted networks; (2) deploy reverse proxy with mandatory authentication ahead of the endpoint; (3) isolate sandbox via network segmentation (VLAN or air-gap); (4) enable detailed logging and alerting on all port 8080 access; (5) disable the agent-sandbox component entirely if not currently in use.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-ima
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Cross-tenant data disclosure in FastGPT 4.14.17 through 4.15.0-beta5 lets a low-privileged tenant user read another tena
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Exploit-DB