FastGPT, an AI Agent building platform by labring, contained a critical vulnerability (CVE-2026-40351) in its password login endpoint before version 4.14.9.5. The vulnerability arises from improper neutralization of special elements in data query logic (CWE-943). Specifically, the endpoint uses TypeScript type assertion without runtime validation, allowing attackers to inject MongoDB query operators (e.g., {"$ne": ""}) as the password field. This NoSQL injection bypasses authentication, permitting unauthorized login as any user, including root administrator. The vulnerability has been addressed in FastGPT version 4.14.9.5.

Successful exploitation allows an unauthenticated attacker to bypass password authentication and gain unauthorized access to any user account, including the root administrator. This leads to full system compromise with confidentiality, integrity, and availability impacts rated high (CVSS 9.8).

Upgrade FastGPT to version 4.14.9.5 or later, where this vulnerability has been fixed. Since the vendor has released a fixed version, applying this official patch is the recommended remediation. Patch status is not explicitly stated in the vendor advisory but the description confirms the fix in 4.14.9.5. No additional mitigations are specified.