VulnerabilityAnalyzed

CVE-2026-40352

In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection.

HIGH 8.8EPSS 0.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.38% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-943
Affected: fastgpt/fastgpt
Source: security-advisories@github.com

References

https://github.com/labring/FastGPT/commit/bd966d479fbe414d02679cf79f9eaaab3d100a2dPatch
https://github.com/labring/FastGPT/releases/tag/v4.14.9.5Product, Release Notes
https://github.com/labring/FastGPT/security/advisories/GHSA-422w-vrfj-72g6Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.