CVE-2026-42302

FastGPT: agent-sandbox vulnerable in 4.14.10–4.14.12 due to entrypoint.sh launching code-server with --auth none and binding to 0.0.0.0:8080, enabling unauthenticated remote code execution and full sandbox access. The issue is mitigated in version 4.14.13. Practical impact is unauthenticated netw...

EUVD-2026-28850

FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution RCE. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to...

CVE-2026-42302

FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution RCE. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to...

CVE-2026-42302 FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox

FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution RCE. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to...

CVE-2026-42302: Missing Authentication for Critical Function

FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution RCE. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to...

PT-2026-39205

Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.10 through 4.14.12 Description The agent-sandbox component allows unauthenticated Remote Code Execution RCE, which is the ability to execute arbitrary commands on a remote machine. The startup script entrypoint.sh...

CVE-2026-41324 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, kibana, opensearch-dashboards, code-server, opensearch-dashboards-fips...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: dbgate-fips, nextcloud-server, homepage, gitlab-rails-ce, drupal, kubeflow-katib, code-server, arangodb, opensearch-dashboards-fips, py3-jupyterlab, langfuse, tensorflow-gpu-jupyter, azurite, actions-runner, saf, argo-workflows, py3-captum, wazuh-dashboard-fips,...

CVE-2026-41324 vulnerabilities

Vulnerabilities for packages: code-server, opensearch-dashboards...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, jupyter-base-notebook, saf, argo-workflows, opensearch-dashboards, langfuse, nextcloud-server, jitsucom-jitsu, npm, code-server, py3-jupyterlab, renovate, sqlpad, prism, kubeflow-pipelines, kubeflow-centraldashboard...

GHSA-RP42-5VXX-QPWR vulnerabilities

Vulnerabilities for packages: code-server, opensearch-dashboards...

GHSA-RP42-5VXX-QPWR vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, kibana, opensearch-dashboards, code-server, opensearch-dashboards-fips...

CVE-2026-27699 vulnerabilities

Vulnerabilities for packages: code-server, opensearch-dashboards, langfuse...

GHSA-5RQ4-664W-9X2C vulnerabilities

Vulnerabilities for packages: code-server, opensearch-dashboards, langfuse...

CVE-2026-27903 vulnerabilities

Vulnerabilities for packages: saf, jupyter-base-notebook, argo-workflows, lerna, pulumi, tileserver-gl, vitess, eslint, ts-patch, kubeflow-katib, renovate, prism, opensearch-dashboards, serve, npm, py3-jupyterlab, node-gyp, pnpm-stage0, code-server...

CVE-2026-27904 vulnerabilities

Vulnerabilities for packages: saf, jupyter-base-notebook, argo-workflows, lerna, pulumi, tileserver-gl, vitess, eslint, ts-patch, kubeflow-centraldashboard, kubeflow-katib, renovate, prism, opensearch-dashboards, serve, npm, py3-jupyterlab, node-gyp, pnpm-stage0, code-server...

GHSA-23C5-XMQV-RM74 vulnerabilities

Vulnerabilities for packages: saf, jupyter-base-notebook, argo-workflows, lerna, pulumi, tileserver-gl, vitess, eslint, ts-patch, kubeflow-centraldashboard, kubeflow-katib, renovate, prism, opensearch-dashboards, serve, npm, py3-jupyterlab, node-gyp, pnpm-stage0, code-server...

GHSA-7R86-CG39-JMMJ vulnerabilities

Vulnerabilities for packages: saf, jupyter-base-notebook, argo-workflows, lerna, pulumi, tileserver-gl, vitess, eslint, ts-patch, kubeflow-katib, renovate, prism, opensearch-dashboards, serve, npm, py3-jupyterlab, node-gyp, pnpm-stage0, code-server...

CVE-2026-27699 vulnerabilities

Vulnerabilities for packages: langfuse-fips, kibana, opensearch-dashboards, code-server, opensearch-dashboards-fips, langfuse...

GHSA-7R86-CG39-JMMJ vulnerabilities

Vulnerabilities for packages: ts-patch, authentik-fips, opentelemetry-auto-instrumentations-node, gitlab-rails-ce, lerna, node-gyp, semaphore, serve, drupal, kubeflow-katib, code-server, arangodb, opensearch-dashboards-fips, py3-jupyterlab, langfuse, actions-runner, saf, argo-workflows, py3-captu...