Remote Code Execution Vulnerability in FastGPT AI Agent Building Platform

CVE-2026-42302

What is CVE-2026-42302?

The agent-sandbox component of FastGPT, an AI Agent building platform, is susceptible to unauthenticated Remote Code Execution. This vulnerability arises from the entrypoint script initializing the code-server with the --auth none flag and exposing the service on all network interfaces (0.0.0.0:8080). As a consequence, any individual with network access to this port can bypass authentication, granting them unfettered control over the sandbox environment. The issue has been addressed in FastGPT version 4.14.13, highlighting the importance of upgrading to safeguard systems from potential exploitation.

References