CVE-2026-40352: FastGPT NoSQL injection in password change endpoint

Summary

FastGPT, an AI Agent building platform, has a NoSQL injection flaw in its password change endpoint in versions prior to 4.14.9.5. An authenticated attacker can inject MongoDB query operators to bypass the "old password" check, changing the password of their own account or others' accounts when combined with ID manipulation, which leads to full account takeover and persistence.

Mitigation

Fixed in version 4.14.9.5.

Topics

• AI agents

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• InfoSuppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor DefenseSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• InfoSay Shibboleth: Fingerprinting the LLMs and Harnesses Behind Agentic AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)