CVE-2026-2975
📋 TL;DR
FastApiAdmin up to version 2.2.0 contains an information disclosure vulnerability in the reset_api_docs function of the custom documentation endpoint. This allows remote attackers to access sensitive information without authentication. All deployments using vulnerable versions are affected.
💻 Affected Systems
- FastApiAdmin
📦 What is this software?
Fastapiadmin by Fastapiadmin
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract sensitive configuration data, API keys, database credentials, or other secrets stored in the application, leading to complete system compromise.
Likely Case
Exposure of internal API documentation, configuration details, or limited sensitive information that could facilitate further attacks.
If Mitigated
With proper network segmentation and access controls, impact would be limited to information within the FastApiAdmin component only.
🎯 Exploit Status
Exploit code is publicly available and requires no authentication. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.1 or later
Vendor Advisory: https://github.com/fastapi-admin/fastapi-admin
Restart Required: Yes
Instructions:
1. Update FastApiAdmin to version 2.2.1 or later using pip: pip install --upgrade fastapi-admin>=2.2.1
2. Restart the FastAPI application
3. Verify the custom documentation endpoint is no longer accessible or properly secured
🔧 Temporary Workarounds
Disable custom documentation endpoint
allRemove or disable the vulnerable custom documentation endpoint component
Modify /backend/app/plugin/init_app.py to remove or comment out the reset_api_docs function and related endpoints
Network access restriction
linuxRestrict access to the FastAPI admin interface using firewall rules
iptables -A INPUT -p tcp --dport [FASTAPI_PORT] -s [TRUSTED_IPS] -j ACCEPT
iptables -A INPUT -p tcp --dport [FASTAPI_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FastApiAdmin from untrusted networks
- Deploy a web application firewall (WAF) with rules to block requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if FastApiAdmin version is 2.2.0 or earlier and if the custom documentation endpoint is accessible via HTTP requestsCheck Version:
pip show fastapi-admin | grep VersionVerify Fix Applied:
After updating, attempt to access the custom documentation endpoint and verify it returns proper authentication errors or is disabled📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /backend/app/plugin/init_app.py or custom documentation endpoints
- Unusual access patterns to admin interfaces
Network Indicators:
- HTTP GET/POST requests to documentation endpoints from untrusted sources
- Traffic spikes to admin interfaces
SIEM Query:
source="web_logs" AND (uri="/backend/app/plugin/init_app.py" OR uri CONTAINS "api_docs")