CVE-2026-42302: FastGPT: Unauthenticated RCE via code-server Misconfiguration in agent-sandbox
CVE-2026-42302 affects the agent-sandbox component of FastGPT, where a startup script runs code-server without authentication on all network interfaces. According to the record, any user with network access to port 8080 can gain full control of the sandbox, and GitHub scores it 9.8 (critical). The issue is fixed in version 4.14.13.
Overview
This advisory covers an unauthenticated remote code execution issue in the agent-sandbox component of FastGPT, an AI agent building platform. According to the record, the startup script entrypoint.sh starts code-server with the --auth none flag and binds it to all interfaces on port 8080.
Impact
The record states that any user with network access to that port can bypass authentication and gain full control over the sandbox environment. The reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) corresponds to a 9.8 critical base score from GitHub. The weakness is classified as CWE-306, Missing Authentication for Critical Function.
Affected products and versions
- Labring FastGPT, from version 4.14.10 up to but not including 4.14.13.
- The description states the issue is patched in version 4.14.13, and the record links a release for that version.
Exploitation status
The CISA KEV entry in the record is not listed, so no active exploitation is confirmed by the sources consulted. The SSVC exploitation field is recorded as poc and the EPSS probability is 0.01295 (percentile 0.69605). These are risk indicators, not evidence of attacks in the wild.
Remediation and mitigation
- Upgrade FastGPT to version 4.14.13 or later, as stated in the advisory description and the linked release.
- Until the upgrade is complete, restrict network access to the sandbox port so that only trusted hosts can reach it, and do not expose it to the internet.
- After patching, confirm that code-server requires authentication and no longer listens on all interfaces.
Detection guidance
- Inventory FastGPT deployments in the affected range and check for listeners on port 8080 bound to all interfaces.
- Review network and access logs for connections to the sandbox port from unexpected sources.
- Verify the running FastGPT version in each environment.
Limitations of the available information
The record has no structured fixed-version field, so the fixed version is taken from the description and the linked release. The record does not describe the exploit path in detail or state whether the sandbox is exposed in default deployments, so those points remain unknown.
Frequently asked questions
Is CVE-2026-42302 known to be actively exploited?
The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted. The SSVC field is recorded as poc, which refers to proof-of-concept status rather than observed attacks.
Which version fixes this issue?
The description states the issue is patched in version 4.14.13. The affected range is from 4.14.10 up to but not including 4.14.13.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.