Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

FastGPT — Vulnerabilities & Security Advisories 20

All 20 CVE vulnerabilities found in FastGPT, with AI-generated Chinese analysis, references, and POCs.

Vendor: labring

CVE IDTitleCVSSSeverityPublished
CVE-2026-44286 FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation CWE-918 8.1AIHighAI2026-05-08
CVE-2026-44284 FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution CWE-918 6.3 Medium2026-05-08
CVE-2026-42345 FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot CWE-918 7.7 High2026-05-08
CVE-2026-42344 FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints CWE-367 6.3 Medium2026-05-08
CVE-2026-42343 FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion CWE-400 7.5AIHighAI2026-05-08
CVE-2026-42302 FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox CWE-306 9.8 Critical2026-05-08
CVE-2026-40352 FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover CWE-943 8.8 High2026-04-17
CVE-2026-40351 FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass CWE-943 9.8 Critical2026-04-17
CVE-2026-40252 Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT CWE-284 8.8 -2026-04-10
CVE-2026-40100 FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default CWE-918 5.3 Medium2026-04-10
CVE-2026-34162 FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft CWE-306 10.0 Critical2026-03-31
CVE-2026-34163 Server-Side Request Forgery via MCP Tools Endpoint in FastGPT CWE-918 7.7 High2026-03-31
CVE-2026-33075 FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml CWE-494 7.5 -2026-03-20
CVE-2026-32128 FastGPT Python Sandbox Bypass of File-Write Restriction CWE-184 6.3 Medium2026-03-11
CVE-2026-26075 Cross-Site Request Forgery (CSRF) in FastGPT CWE-352 5.3AIMediumAI2026-02-12
CVE-2026-26003 FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack CWE-601 6.5AIMediumAI2026-02-10
CVE-2025-62612 FastGPT File Reading Node SSRF Vulnerability CWE-918 9.1AICriticalAI2025-10-22
CVE-2025-52552 FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS CWE-601 6.1AIMediumAI2025-06-21
CVE-2025-49131 FastGPT Sandbox Vulnerable to Sandbox Bypass CWE-732 6.3 Medium2025-06-09
CVE-2025-27600 FastGPT SSRF CWE-918 7.5 -2025-03-06

All 20 known CVE vulnerabilities affecting FastGPT with full Chinese analysis, references, and POCs where available.