TI-2026-30610 CVE-2026-42302
FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox
Priority HIGH 82
FastGPT is an AI Agent building platform.
labring
Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
labring records in CISA KEVNo labring vulnerabilities are listed in CISA KEV.
Records
19 records
TI-2026-48466 CVE-2026-68929
FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
Priority HIGH 81
FastGPT is an open-source LLM platform for building AI applications on a knowledge base.
TI-2026-44161 CVE-2026-61684
FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')
Priority HIGH 77
FastGPT is a knowledge-based AI application platform.
TI-2026-44148 CVE-2026-61644
Incorrect authorization in labring FastGPT
Priority HIGH 67
FastGPT is a knowledge-based AI application platform.
TI-2026-39440 CVE-2026-54607
FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)
Priority HIGH 67
FastGPT is a knowledge-based AI application platform.
TI-2026-30646 CVE-2026-42343
FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion
Priority HIGH 67
FastGPT is an AI Agent building platform.
TI-2026-57936 CVE-2026-84301
FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
Priority MEDIUM 61
FastGPT is an open-source LLM platform for building AI applications on a knowledge base.
TI-2026-44149 CVE-2026-61646
FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects
Priority MEDIUM 61
FastGPT is a knowledge-based AI application platform.
TI-2026-39434 CVE-2026-54601
FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion
Priority MEDIUM 61
FastGPT is an open source AI knowledge base platform.
TI-2026-32258 CVE-2026-44287
FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable
Priority MEDIUM 61
FastGPT is an AI Agent building platform.
Priority MEDIUM 61
FastGPT is an AI Agent building platform.
TI-2026-30647 CVE-2026-42344
FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints
Priority MEDIUM 61
FastGPT is an AI Agent building platform.
TI-2026-44147 CVE-2026-61643
FastGPT: workflow runtime can execute another user's private HTTP toolset
Priority MEDIUM 60
FastGPT is a knowledge-based AI application platform.
TI-2026-37284 CVE-2026-50562
FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows
Priority MEDIUM 45
FastGPT is a knowledge-based AI application platform.
TI-2026-32257 CVE-2026-44286
FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation
Priority MEDIUM 45
FastGPT is an AI Agent building platform.
TI-2026-39987 CVE-2026-55418
FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)
Priority MEDIUM 44
FastGPT is an open source AI knowledge base platform.
TI-2026-32256 CVE-2026-44285
FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API
Priority LOW 33
FastGPT is an AI Agent building platform.
TI-2026-30648 CVE-2026-42345
Server-side request forgery in labring FastGPT
Priority LOW 33
FastGPT is an AI Agent building platform.
TI-2026-39435 CVE-2026-54602
FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord
Priority LOW 31
FastGPT is a knowledge-based AI application platform.