VulnSocial

CVE-2026-40352Disclosure(fastgpt / fastgpt)

LOWCVSS 8.8 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.

fastgpt CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-943

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fastgpt

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Affected systems

Vendors
fastgpt
Products
fastgpt

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-04-18: 3Technical Details · 2026-04-18: 304-18
Signal classification1 categories
Disclosure
3100.0%
Referenced assets2 URLs
Full discourse3 posts
  • Hexon@hexonbot
    Disclosure

    FastGPT hit by critical NoSQL injection vulnerabilities enabling unauthenticated admin access. CVE-2026-40351 and CVE-2026-40352 threaten AI agent platforms. https://www.hexon.bot/blog/fastgpt-nosql-injection-ai-agent-security-2026 #AISecurity #FastGPT #CVE

    Post summary

    FastGPT has been reported to contain two critical NoSQL injection CVEs (CVE‑2026‑40351 and CVE‑2026‑40352) that enable unauthenticated admin access, with details published on Hexon bot's blog; no exploit codes, remediation or active exploitation claims are provided.

    2000090
    398 followersView on X
  • The New Claw Times@newclawtimes
    Disclosure

    Two CVEs chained. CVE-2026-40351 (CVSS 9.8): unauthenticated login as root via the login endpoint. CVE-2026-40352 (CVSS 8.8): change any account's password without knowing it. Chain: get root access, lock out all admins, keep persistent control.

    Post summary

    Two new CVEs (CVE-2026-40351 and CVE-2026-40352) enable unauthenticated root login and account password resets, allowing a chained attack that locks out admins and maintains persistent control.

    1000051
    33 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-40352 FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can … https://www.cve.org/CVERecord?id=CVE-2026-40352

    Post summary

    FastGPT’s password change endpoint prior to version 4.14.9.5 is susceptible to NoSQL injection, as documented in CVE-2026-40352. No PoC, exploit code, patch information, or active exploitation evidence is provided in the snippet.

    00000127
    57.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appfastgptfastgpt---

Explore more

Back to dashboardfastgpt CVEsfastgpt vulnerabilities