CVE-2026-40352: FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40352?
CVE-2026-40352 has a high severity due to its potential for account takeover through NoSQL injection.
How do I fix CVE-2026-40352?
To fix CVE-2026-40352, upgrade FastGPT to version 4.14.9.5 or later.
What kind of injection vulnerability is present in CVE-2026-40352?
CVE-2026-40352 contains a NoSQL injection vulnerability specifically affecting the password change endpoint.
Who is affected by CVE-2026-40352?
CVE-2026-40352 affects users of FastGPT versions prior to 4.14.9.5.
What can an attacker do with CVE-2026-40352?
An attacker can exploit CVE-2026-40352 to bypass the old password verification and change the password of any account.