CVE-2026-42302CRITICAL 9.8EPSS p49.0%

CVE-2026-42302CVE-2026-42302

Description

FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution (RCE). The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080). This configuration allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment. This issue has been patched in version 4.14.13.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.72% probability of exploitation · percentile 49.0% · 2026-06-18T12:00:27Z
Published2026-05-08
Last modified2026-05-12

Underlying weaknesses· 1

CWE-306

References

  1. https://github.com/labring/FastGPT/commit/9d1cafce9241430fb5bcdd646455055c5f4ae0a4
  2. https://github.com/labring/FastGPT/pull/6781
  3. https://github.com/labring/FastGPT/releases/tag/v4.14.13
  4. https://github.com/labring/FastGPT/security/advisories/GHSA-34rc-438g-7w78
  5. https://github.com/labring/FastGPT/security/advisories/GHSA-34rc-438g-7w78

1

TypeTargetConfidenceTier
WeaknessMissing Authentication for Critical Functioncwe-3060%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-34162
CVE
CVE-2026-33075
CVE
CVE-2026-44287
CVE
CVE-2025-49131
CVE
CVE-2026-44285
CVE
CVE-2026-40252
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.