CVE-2026-40351: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in labring FastGPT
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object (e.g., {"$ne": ""}) as the password field. This NoSQL injection bypasses the password check, enabling login as any user including the root administrator. This issue has been fixed in version 4.14.9.5.
AI Analysis
Technical Summary
FastGPT, an AI Agent building platform by labring, suffers from a NoSQL injection vulnerability (CWE-943) in its password login endpoint before version 4.14.9.5. The vulnerability arises because the endpoint uses TypeScript type assertion without runtime validation, permitting attackers to inject MongoDB query operators (e.g., {"$ne": ""}) as the password field. This bypasses authentication checks and allows unauthorized access as any user, including root administrators. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity. The issue is resolved in FastGPT version 4.14.9.5.
Potential Impact
An unauthenticated attacker can bypass password authentication and gain unauthorized access to any user account, including the root administrator. This leads to full compromise of the affected FastGPT instance, with complete confidentiality, integrity, and availability impact. No exploits in the wild are currently known.
Mitigation Recommendations
Upgrade FastGPT to version 4.14.9.5 or later, where this vulnerability has been fixed. Since the vendor advisory confirms the fix in this version, applying this official update fully mitigates the issue. No additional mitigations are specified or required.
CVE-2026-40351: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in labring FastGPT
Description
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object (e.g., {"$ne": ""}) as the password field. This NoSQL injection bypasses the password check, enabling login as any user including the root administrator. This issue has been fixed in version 4.14.9.5.
CVSS v3.1
Score 9.8critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FastGPT, an AI Agent building platform by labring, suffers from a NoSQL injection vulnerability (CWE-943) in its password login endpoint before version 4.14.9.5. The vulnerability arises because the endpoint uses TypeScript type assertion without runtime validation, permitting attackers to inject MongoDB query operators (e.g., {"$ne": ""}) as the password field. This bypasses authentication checks and allows unauthorized access as any user, including root administrators. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity. The issue is resolved in FastGPT version 4.14.9.5.
Potential Impact
An unauthenticated attacker can bypass password authentication and gain unauthorized access to any user account, including the root administrator. This leads to full compromise of the affected FastGPT instance, with complete confidentiality, integrity, and availability impact. No exploits in the wild are currently known.
Mitigation Recommendations
Upgrade FastGPT to version 4.14.9.5 or later, where this vulnerability has been fixed. Since the vendor advisory confirms the fix in this version, applying this official update fully mitigates the issue. No additional mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-10T22:50:01.359Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e2a83ebdfbbecc5994f144
Added to database: 4/17/2026, 9:38:06 PM
Last enriched: 4/25/2026, 2:56:38 AM
Last updated: 6/5/2026, 4:51:25 AM
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.