{"data":{"id":"033b490b-417c-488c-a6d6-585a55582752","title":"CVE-2026-40351: FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses…","summary":"CVE-2026-40351 affects FastGPT, an AI Agent building platform, in versions prior to 4.14.9.5. The password-based login endpoint uses TypeScript type assertion without runtime validation, so an unauthenticated attacker can submit a MongoDB query operator object such as {\"$ne\": \"\"} as the password field. This NoSQL injection bypasses the password check and allows login as any user, including the root administrator.","solution":"This issue has been fixed in version 4.14.9.5.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40351","publishedAt":"2026-04-17T22:16:32.793Z","cveId":"CVE-2026-40351","cweIds":["CWE-943"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["FastGPT"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"FastGPT NoSQL injection in password-based login endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00597,"epssCheckedAt":"2026-10-23T00:09:19.956Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-19T18:08:58.221Z","patchAvailable":null,"disclosureDate":"2026-04-17T22:16:32.793Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}