Fastgpt EUVD-2026-23557

No special conditions - remote unauthenticated exploitation against default configurations of FastGPT installations prior to version 4.14.9.5. The password-based login endpoint is enabled by default and typically exposed on standard HTTP/HTTPS ports (80/443) for legitimate user access. Exploitation succeeds against any FastGPT instance where the vulnerable authentication code path is reachable over the network. No user interaction, privileged access, or non-default configuration required. The only limiting factor is network accessibility to the login endpoint - instances behind VPNs, IP allowlists, or private networks have reduced exposure but remain vulnerable to authenticated network users or lateral movement scenarios. CVSS vector PR:N confirms zero authentication requirements.

Real-world risk is CRITICAL based on multiple converging signals. CVSS 9.8 accurately reflects severity: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete system compromise (C:H/I:H/A:H). The attack grants immediate root administrator access, enabling full platform takeover including AI model manipulation, data exfiltration, and service disruption. Exploitation is trivial - a single HTTP POST with crafted JSON bypasses all authentication. While not yet listed in CISA KEV (suggesting no confirmed widespread exploitation campaigns), the GitHub security advisory publicly documents the vulnerability mechanics with sufficient detail for rapid weaponization. FastGPT is an open-source platform likely deployed in enterprise AI/LLM workflows, making exposed instances high-value targets. The combination of maximum CVSS severity, public technical disclosure, trivial exploitation complexity, and administrator-level impact makes this an immediate patching priority. EPSS score unavailable but would likely exceed 60% given public details and high impact. No conflicting signals detected - all indicators align on critical severity.

An unauthenticated attacker identifies a FastGPT instance exposed on the public internet through Shodan or targeted reconnaissance. They send an HTTP POST request to the password login endpoint with JSON payload containing username 'root' and password field set to {"$ne": ""} instead of a string. The backend MongoDB query evaluates the injected operator, matching any root account with a non-empty password hash, and returns successful authentication. The attacker receives a valid session token granting full administrative access to the FastGPT platform, enabling them to exfiltrate AI training data, modify chatbot behaviors, access integrated systems via stored API credentials, or deploy malicious AI agents. GitHub security advisory GHSA-x8mx-2mr7-h9xg provides sufficient technical detail for exploit development though no public POC is confirmed available.