Critical severity · published May 8, 2026
CVE-2026-42302
FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution (RCE). The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080). This configuration allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment. This issue has been patched in version 4.14.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
FastGPT · labring
>= 4.14.10, < 4.14.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42302
github.com
https://github.com/labring/FastGPT/commit/9d1cafce9241430fb5bcdd646455055c5f4ae0a4
github.com
https://github.com/labring/FastGPT/pull/6781
github.com
https://github.com/labring/FastGPT/releases/tag/v4.14.13
github.com
https://github.com/labring/FastGPT/security/advisories/GHSA-34rc-438g-7w78
More from FastGPT
10.0
CVE-2026-34162
FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft
9.9
CVE-2025-49131
FastGPT Sandbox Vulnerable to Sandbox Bypass
9.8
CVE-2026-40351
FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass
9.3
CVE-2026-68929
FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
9.3
CVE-2026-50562
FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows