Is CVE-2026-33075 actively exploited?

No active exploitation of CVE-2026-33075 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33075 be exploited remotely?

Yes. CVE-2026-33075 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33075?

CVE-2026-33075 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-33075

HIGH

CVE-2026-33075

CWE-494Published: March 20, 2026· Updated: Mar 23, 2026

8.8

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.9th

Official Description

FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration by any external contributor. It uses pull_request_target (which runs with access to repository secrets) but checks out code from the pull request author's fork, then builds and pushes Docker images using attacker-controlled Dockerfiles. This also enables a supply chain attack via the production container registry. A patch was not available at the time of publication.

NVD Source

Technical Analysis

CVE-2026-33075 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.