CVE-2026-40351: FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object (e.g., {"$ne": ""}) as the password field. This NoSQL injection bypasses the password check, enabling login as any user including the root administrator. This issue has been fixed in version 4.14.9.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40351?
CVE-2026-40351 has been classified as a critical vulnerability due to its potential to bypass authentication.
How do I fix CVE-2026-40351?
To fix CVE-2026-40351, upgrade FastGPT to version 4.14.9.5 or later.
What type of vulnerability is CVE-2026-40351?
CVE-2026-40351 is a NoSQL Injection vulnerability affecting the loginByPassword function in FastGPT.
Who is affected by CVE-2026-40351?
CVE-2026-40351 affects all versions of FastGPT prior to 4.14.9.5.
Can CVE-2026-40351 be exploited remotely?
Yes, CVE-2026-40351 can be exploited remotely by unauthenticated attackers.