CVE-2026-40352
Fastgpt ≤ 4.14.9.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-40352 is a high-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Fastgpt Fastgpt. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Other ATLAS/OWASP Terms risk domain.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40352 is a NoSQL injection vulnerability in the password change endpoint of FastGPT, an AI Agent building platform. It affects versions prior to 4.14.9.5 and stems from improper handling of MongoDB query operators (CWE-943). The flaw has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
An authenticated attacker with a low-privileged session can exploit this vulnerability to bypass the required "old password" verification. By injecting MongoDB query operators, they can change the password of their own account without knowing the current one. If combined with ID manipulation, the attacker could target other accounts, achieving full account takeover and long-term persistence on the platform.
The vulnerability has been addressed in FastGPT version 4.14.9.5. Mitigation details, including the fixing commit and release notes, are documented in the project's GitHub security advisory (GHSA-422w-vrfj-72g6), release page (v4.14.9.5), and the specific patch commit (bd966d479fbe414d02679cf79f9eaaab3d100a2d). Security practitioners should upgrade to the patched version and review access controls for password management endpoints.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23559
Vulnerability Data
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who…
more
has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops unneutralized special elements from reaching query logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require parameterized queries and input neutralization to prevent query-logic injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.
Secure development life cycle mandates input validation and query parameterization that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection and improper query construction.
Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.
Secure coding standards require proper neutralization of special elements in all data queries.
Outsourced development agreements can require secure coding practices, indirectly mitigating the weakness.