Executive brief
FastGPT, a platform for building AI agents, contains a security flaw in its sandbox component that allows unauthorized users to take control of the system. By exploiting a misconfiguration in the built-in code editor, an attacker can remotely execute commands, steal sensitive API keys, or access private data without needing a password. This could lead to a total compromise of the AI environment and potentially allow attackers to reach other internal company systems.
Technical details
The vulnerability exists in the 'agent-sandbox' component of FastGPT between versions 4.14.10 and 4.14.13. The root cause is located in the 'entrypoint.sh' startup script, which initializes 'code-server' (a web-based VS Code IDE) with the '--auth none' flag while binding the service to all network interfaces (0.0.0.0:8080). This configuration allows any attacker with network access to the port to bypass authentication and gain a full interactive shell within the sandbox container. An attacker can use this access to leak environment variables, steal API keys, or perform lateral movement within the internal network. The issue has been addressed in version 4.14.13 by requiring authentication and changing default port configurations.
Affected products
- labring FastGPT >= 4.14.10, < 4.14.13
Timeline
- 2026-04-20: patched: Fix committed to repository
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD