CVE-2026-40351

{
  "id": "CVE-2026-40351",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-17T22:16:32.793",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object (e.g., {\"$ne\": \"\"}) as the password field. This NoSQL injection bypasses the password check, enabling login as any user including the root administrator. This issue has been fixed in version 4.14.9.5."
    },
    {
      "lang": "es",
      "value": "FastGPT es una plataforma de creación de agentes de IA. En versiones anteriores a la 4.14.9.5, el endpoint de inicio de sesión basado en contraseña utiliza la aserción de tipo de TypeScript sin validación en tiempo de ejecución, permitiendo a un atacante no autenticado pasar un objeto de operador de consulta de MongoDB (p. ej., {’$ne’: ’’}) como el campo de contraseña. Esta inyección NoSQL omite la verificación de contraseña, permitiendo el inicio de sesión como cualquier usuario, incluido el administrador raíz. Este problema ha sido solucionado en la versión 4.14.9.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "labring",
          "product": "FastGPT",
          "versions": [
            {
              "version": "< 4.14.9.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T14:47:36.369173Z",
          "id": "CVE-2026-40351",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-943"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fastgpt:fastgpt:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.14.9.5",
              "matchCriteriaId": "DE20269A-5497-4727-B3DD-3EDC1E1F234E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/labring/FastGPT/commit/bd966d479fbe414d02679cf79f9eaaab3d100a2d",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/labring/FastGPT/releases/tag/v4.14.9.5",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/labring/FastGPT/security/advisories/GHSA-x8mx-2mr7-h9xg",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}