CVE-2026-26003CWE-601

FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack

Medium · published February 10, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
41.9
In the wild
Unconfirmed
What it is

FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through FastGPT/api/plugin/xxx without authentication, thereby threatening the plugin system. This may cause the plugin system to crash and the loss of plugin installation status, but it will not result in key leakage. For older versions, as there are only operation interfaces for obtaining information, the impact is almost negligible. This vulnerability is fixed in 4.14.5-fix.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
EPSS
0.00500 · 41.9th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-02-10T17:52Z
EPSS history
Timeline
  • 10 FEB 17:52Z
    FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack
    cvelistv5