CVE-2026-26003

MEDIUM EPSS 13.7%
Published Feb 10, 20264mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Feb 10, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through FastGPT/api/plugin/xxx without authentication, thereby threatening the plugin system. This may cause the plugin system to crash and the loss of plugin installation status, but it will not result in key leakage. For older versions, as there are only operation interfaces for obtaining information, the impact is almost negligible. This vulnerability is fixed in 4.14.5-fix.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
13.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-601

Affected Products 2

VendorProductVersionRange
fastgptfastgpt*≥4.14.0  –  <4.14.5
fastgptfastgpt4.14.5any

References 3

  • github.com https://github.com/labring/FastGPT/commit/0beb52a2f3dc4067aab011cc98122d1352823b0c
    Patch
  • github.com https://github.com/labring/FastGPT/releases/tag/v4.14.5-fix
    Release Notes
  • github.com https://github.com/labring/FastGPT/security/advisories/GHSA-wcrg-g824-9gfg
    Vendor Advisory

Remediation

  • github.com https://github.com/labring/FastGPT/commit/0beb52a2f3dc4067aab011cc98122d1352823b0c
    Patch