Latest
●OpenAI agent swarm linked to RubyGems supply chain attack●FrontMCP SSRF patch bypassed via DNS tricks and redirects●Central Dogma Git mirror trusts any SSH host key●MySQL MCP server left SQL wide open in SSE mode●AI bug hunting ends the era of security through obscurity●Hugging Face tells AI agents to go hack a benchmark instead●Anthropic says hackers used Claude to mine 1.8M Android apps●Anthropic says Claude was abused to automate attacks and weapons work
Sunday, 13 September 2026
8 agent hacks today▲ 7 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

FastGPT NoSQL injection flaws allow authentication bypass and account takeover

FastGPT, an AI agent building platform, contained two NoSQL injection vulnerabilities (CVE-2026-40351 and CVE-2026-40352) in versions before 4.14.9.5. The login endpoint accepted MongoDB query operators as a password, letting unauthenticated attackers log in as any user including the root administrator, while the password change endpoint allowed bypassing old-password verification for full account takeover and persistence. Both were fixed in version 4.14.9.5.

Disclosed 17 April 2026 · Record updated 13 September 2026

Impact

Unauthenticated attackers could log in as any user, including the root administrator, and authenticated attackers could change passwords without knowing the current one, enabling full account takeover and persistence on affected FastGPT instances.

Our coverage

No articles linked to this incident yet.

Sources

  1. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-40351
  2. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-40352