Vulnerabilities

TI-2026-57936 CVE-2026-84301

FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

MEDIUM 61

FastGPT is an open-source LLM platform for building AI applications on a knowledge base.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00285 Published 2026-09-22 Fixed in 4.15.2 CWE-918

TI-2026-48466 CVE-2026-68929

FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

HIGH 81

FastGPT is an open-source LLM platform for building AI applications on a knowledge base.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00435 Published 2026-08-27 Fixed in 4.14.29, 4.15.2 CWE-306

TI-2026-44147 CVE-2026-61643

FastGPT: workflow runtime can execute another user's private HTTP toolset

MEDIUM 60

FastGPT is a knowledge-based AI application platform.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.00193 Published 2026-07-15 Fixed in 4.15.0-beta5 CWE-863

TI-2026-37284 CVE-2026-50562

FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows

MEDIUM 45

FastGPT is a knowledge-based AI application platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00214 Published 2026-07-15 No fix listed CWE-266

TI-2026-44149 CVE-2026-61646

FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects

MEDIUM 61

FastGPT is a knowledge-based AI application platform.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-15 Fixed in 4.15.0-beta5 CWE-918

TI-2026-44148 CVE-2026-61644

Incorrect authorization in labring FastGPT

HIGH 67

FastGPT is a knowledge-based AI application platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00309 Published 2026-07-15 Fixed in 4.15.0-beta5 CWE-863

TI-2026-44161 CVE-2026-61684

FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')

HIGH 77

FastGPT is a knowledge-based AI application platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00386 Published 2026-07-15 No fix listed CWE-798

TI-2026-39435 CVE-2026-54602

FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord

LOW 31

FastGPT is a knowledge-based AI application platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-07 Fixed in 4.15.0 CWE-639

TI-2026-39440 CVE-2026-54607

FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)

HIGH 67

FastGPT is a knowledge-based AI application platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00368 Published 2026-07-07 Fixed in 4.15.0-beta4 CWE-918

TI-2026-39987 CVE-2026-55418

FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

MEDIUM 44

FastGPT is an open source AI knowledge base platform.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00482 Published 2026-07-07 Fixed in 4.15.0-beta5 CWE-639

TI-2026-39434 CVE-2026-54601

FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion

MEDIUM 61

FastGPT is an open source AI knowledge base platform.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00296 Published 2026-07-07 Fixed in 4.15.0-beta4 CWE-915

TI-2026-32258 CVE-2026-44287