CVE-2026-42302 Details
Description
FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution (RCE). The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080). This configuration allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment. This issue has been patched in version 4.14.13.
A remote code execution vulnerability has been identified in the agent-sandbox component of FastGPT, affecting versions 4.14.10 prior to 4.14.13. The vulnerability arises from a misconfiguration in the startup script, which disables authentication and exposes the service to all network interfaces. This allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment.
Users can update to FastGPT version 4.14.13 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/labring/FastGPT/security/advisories/GHSA-34rc-438g-7w78 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/labring/FastGPT/commit/9d1cafce9241430fb5bcdd646455055c5f4ae0a4 | [email protected] | Source CodeVendor |
| https://github.com/labring/FastGPT/pull/6781 | [email protected] | Issue TrackingVendor |
| https://github.com/labring/FastGPT/releases/tag/v4.14.13 | [email protected] | Release NotesVendor |
| https://github.com/labring/FastGPT/security/advisories/GHSA-34rc-438g-7w78 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| labring FastGPT | All versions |
CPE
Remediation
| |
| labring FastGPT agent-sandbox | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |