CVE-2026-42302: FastGPT Agent-Sandbox RCE Vulnerability

CVE-2026-42302 Overview

FastGPT is an AI Agent building platform developed by labring. CVE-2026-42302 is an unauthenticated Remote Code Execution (RCE) vulnerability in the agent-sandbox component of FastGPT. The startup script entrypoint.sh launches code-server with --auth none and binds the service to 0.0.0.0:8080, exposing it on all network interfaces without authentication. Any attacker with network access to the port can take full control of the sandbox environment. The flaw affects FastGPT versions 4.14.10 through versions before 4.14.13 and is patched in version 4.14.13. The weakness is categorized as Missing Authentication for Critical Function [CWE-306].

Critical Impact

Unauthenticated attackers reaching TCP port 8080 on the sandbox container can execute arbitrary code with the privileges of the code-server process, leading to complete sandbox compromise.

Affected Products

• FastGPT versions 4.14.10 through 4.14.12
• FastGPT agent-sandbox component (projects/agent-sandbox/entrypoint.sh)
• Deployments exposing the agent-sandbox container port 8080 to untrusted networks

Discovery Timeline

• 2026-05-08 - CVE-2026-42302 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42302

Vulnerability Analysis

The FastGPT agent-sandbox container runs code-server to provide an in-browser development environment for AI agent skills. The container entrypoint script started code-server with two insecure flags: --auth none disabled password protection and --bind-addr 0.0.0.0:8080 exposed the listener on every network interface. Combined, these settings allowed any client that could reach port 8080 to load the code-server web interface and use its built-in terminal and file editor to execute commands inside the container. Because code-server exposes shell access by design, authentication bypass directly converts into arbitrary command execution.

Root Cause

The root cause is missing authentication on a privileged interface [CWE-306]. The entrypoint script hardcoded --auth none, removing the only access control on the code-server HTTP endpoint, while binding to 0.0.0.0 rather than a loopback or internal address. The patched configuration removes both flags and moves the listener to port 44772, isolating the service from external traffic by default.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker scans for exposed port 8080 on FastGPT deployments, opens the code-server interface in a browser, and spawns a terminal to run arbitrary commands. From the sandbox, the attacker can read agent code, exfiltrate secrets mounted into the container, pivot to internal services, or stage further attacks against the FastGPT control plane.

# Security patch in projects/agent-sandbox/entrypoint.sh
# Source: https://github.com/labring/FastGPT/commit/9d1cafce9241430fb5bcdd646455055c5f4ae0a4

# Start code-server or sleep forever
if [ "${_ENABLE_CODE_SERVER}" = "true" ]; then
-  # --bind-addr 0.0.0.0:8080 allows access from outside the container
-  # --auth none removes password protection
   exec code-server \
-       --bind-addr 0.0.0.0:8080 \
-       --auth none \
        --disable-telemetry \
        --disable-update-check \
        --disable-workspace-trust \

The companion change in packages/service/core/agentSkills/sandboxConfig.ts moves the target port from 8080 to 44772, reducing the attack surface for any residual exposure.

Detection Methods for CVE-2026-42302

Indicators of Compromise

• Unexpected inbound TCP connections to port 8080 on agent-sandbox containers from non-FastGPT source addresses.
• HTTP requests to code-server paths such as /?folder= or /stable-*/static/ originating from external networks.
• New or modified files under /home/sandbox/workspace that were not deployed by the agent skill workflow.
• Outbound connections from the sandbox container to unfamiliar hosts, indicating possible reverse shells or data exfiltration.

Detection Strategies

• Inspect running FastGPT deployments for code-server processes started with --auth none or --bind-addr 0.0.0.0:8080.
• Review container image versions and reject agent-sandbox images built from FastGPT 4.14.10 through 4.14.12.
• Alert on shell spawns (/bin/sh, /bin/bash) parented by the code-server process inside sandbox containers.

Monitoring Recommendations

• Log and audit egress traffic from sandbox containers and baseline normal destinations.
• Monitor Kubernetes or Docker network policies for changes that expose port 8080 externally.
• Track FastGPT release versions across environments and flag any host running an affected build.

How to Mitigate CVE-2026-42302

Immediate Actions Required

• Upgrade FastGPT to version 4.14.13 or later, which removes the --auth none and --bind-addr 0.0.0.0:8080 flags from entrypoint.sh.
• Block external access to TCP port 8080 on any host running the agent-sandbox container until the upgrade is complete.
• Rotate any credentials, API keys, or tokens that may have been accessible from the sandbox workspace.

Patch Information

The fix is delivered in FastGPT v4.14.13. The patch removes the insecure code-server flags and changes the configured targetPort from 8080 to 44772. See the GitHub Security Advisory GHSA-34rc-438g-7w78, the Pull Request #6781, the commit 9d1cafc, and the v4.14.13 release notes.

Workarounds

• Set the _ENABLE_CODE_SERVER environment variable to a value other than true to prevent code-server from starting in the sandbox.
• Restrict the sandbox container network with firewall rules or Kubernetes NetworkPolicy objects so that only the FastGPT backend can reach the service.
• Bind code-server to 127.0.0.1 and front it with an authenticated reverse proxy if the editor must remain enabled before upgrading.

# Example Kubernetes NetworkPolicy restricting access to the agent-sandbox pod
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fastgpt-agent-sandbox-restrict
spec:
  podSelector:
    matchLabels:
      app: fastgpt-agent-sandbox
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: fastgpt-backend
      ports:
        - protocol: TCP
          port: 8080