CVE-2026-40351
NoSQL Injection in FastGPT Allows Unauthorized Root Login
Publication date: 2026-04-17
Last updated on: 2026-04-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fastgpt | fastgpt | to 4.14.9.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-943 | The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FastGPT versions prior to 4.14.9.5. The password-based login endpoint uses TypeScript type assertion without runtime validation, which allows an unauthenticated attacker to pass a MongoDB query operator object (such as {"$ne": ""}) as the password field. This leads to a NoSQL injection that bypasses the password check, enabling the attacker to log in as any user, including the root administrator.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an unauthenticated attacker to bypass authentication controls and gain access to any user account, including the root administrator. This can lead to full system compromise, unauthorized data access, data modification, and disruption of services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade FastGPT to version 4.14.9.5 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker to bypass password authentication and gain access as any user, including the root administrator. Such unauthorized access can lead to exposure, modification, or deletion of sensitive data.
Consequently, this poses a significant risk to compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive personal and health information.
Failure to prevent unauthorized access could result in violations of these regulations, potentially leading to legal penalties, data breaches, and loss of trust.