FastGPT CVE-2026-44286

The vulnerability requires the attacker to be an authenticated user with App editing privileges to craft or modify a workflow node. The lafModule workflow node with fetchData function must be present and executable within the workflow. The URL parameter passed to fetchData must be user-controllable (either directly from workflow configuration or from input data). Exploitation is limited to the scope of what the FastGPT application process can reach network-wise-typically internal services on the same network segment or cloud metadata endpoints accessible from the application server. Non-default configurations that restrict outbound network access or place the FastGPT application behind a strict egress firewall would limit practical exploitation, but the vulnerability exists in default configurations.

The CVSS v4.0 score of 2.3 with vector AV:N/AC:L/AT:P/PR:L indicates network-accessible but low-impact exploitation with attack time penalty (AT:P) and low-privilege requirement (PR:L). The CVSS severity downgrade from typical SSRF severity (often high or critical) is driven by: (1) the information disclosure impact is limited (VI:L with VC:N/VA:N/SA:N), suggesting the vulnerability does not enable remote code execution or direct data exfiltration; (2) authenticated access is required (PR:L), limiting the attack surface to users with App editing privileges or the attacker must be an authenticated user; (3) AT:P indicates attack-time preparation or user interaction may be necessary. However, the practical risk assessment must account for the attack vector being network-accessible (AV:N) and low complexity (AC:L). In a multi-tenant SaaS deployment, any authenticated user with App editing privileges becomes an attacker vector, making this a potential lateral movement or reconnaissance tool to enumerate internal infrastructure. The real-world risk depends heavily on deployment model: in self-hosted environments with restricted authentication, risk is lower; in public or loosely-managed instances, risk is elevated. No CISA KEV status provided, no public exploit code referenced, and no active exploitation reported-this appears to be a coordinated disclosure with vendor-released patch available.

An authenticated user with App editing privileges creates or modifies a workflow that includes a lafModule node with a fetchData function. The attacker configures the node to fetch from a user-controlled URL parameter and sets it to an internal address such as http://169.254.169.254/latest/meta-data (AWS metadata endpoint) or http://localhost:6379 (common Redis port). When the workflow is executed, the fetchData function sends the HTTP request without validating the URL against the internal blocklist, allowing the attacker to enumerate internal services, extract metadata, or probe internal infrastructure.