Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through FastGPT/api/plugin/xxx without authentication, thereby threatening the plugin system. This may cause the plugin system to crash and the loss of plugin installation status, but it will not result in key leakage. For older versions, as there are only operation interfaces for obtaining information, the impact is almost negligible. This vulnerability is fixed in 4.14.5-fix.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-26003 Unauthenticated Access to Plugin System in FastGPT 4.14.0-4.14.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26003
Post summary
The CVE-2026-26003 vulnerability, enabling unauthenticated access to FastGPT’s plugin system in versions 4.14.0‑4.14.5, has been disclosed with a link to additional details.
CVE-2026-26003 FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through FastGPT/api/plugin/xxx without authentication… https://www.cve.org/CVERecord?id=CVE-2026-26003
Post summary
FastGPT’s plugin API (versions 4.14.0‑4.14.5) has a disclosed authentication bypass, but no PoC, exploit, or patch details are provided.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastgpt | fastgpt | - | - | - |
| App | fastgpt | fastgpt | 4.14.5 | - | - |