FastGPT CVE-2026-50562

Exploitation requires that the target repository be running the vulnerable preview build/push workflows (preview-docs-build.yml, preview-fastgpt-build.yml, preview-docs-push.yml, preview-fastgpt-push.yml) at commit 22ebfacbb43311e9b73294040ae0eb87390c6bba or earlier, with the workflow_run push jobs configured to download artifacts produced by fork-PR builds and, for the docs pipeline, with secrets.KUBE_CONFIG_CN available to the deploy step. The concrete prerequisite is simply the ability to open a pull request against the repository (default for any GitHub user); no authentication into the project, no maintainer approval, and no user interaction are needed (PR:N/UI:N). The limiting factor is that this only affects the project's own CI/CD supply chain - a fork of the repo without the CN cluster secret or an environment where fork-PR workflows require manual approval is not exploitable, and the impact does not extend to independently deployed end-user FastGPT instances.

The GitHub-assigned CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L) reflects a network-reachable, no-authentication, no-interaction attack with high integrity impact on the vulnerable CI system and high confidentiality/integrity impact on subsequent systems (the registry and Kubernetes cluster). The realistic barrier to exploitation is low: anyone can open a pull request, and no special account privileges are needed, so PR:N is justified. Countervailing factors are that this is a repository-supply-chain/CI weakness rather than a flaw in deployed FastGPT instances - the blast radius is the project's own build infrastructure, GHCR namespace, and CN cluster, not end-user installations. No EPSS score was provided and there is no KEV listing or public POC, suggesting no observed exploitation; the risk is primarily one of latent supply-chain compromise if a targeted attacker crafts a malicious PR. Note the input vector marks VC:N (no direct confidentiality on the CI system) yet the description explicitly involves deploying with secrets.KUBE_CONFIG_CN, which is a secret-exposure/confidentiality concern captured under SC:H - treat the kubeconfig secret as at risk.

A malicious external contributor opens a pull request that modifies the document/ tree or the FastGPT build context so that the resulting Docker image contains attacker code. The low-privilege build workflow packages this poisoned image as a CI artifact, and the privileged workflow_run push job then downloads it, pushes it to GHCR, and deploys the docs preview to the CN Kubernetes cluster using secrets.KUBE_CONFIG_CN - handing the attacker a foothold in the registry and cluster and potential access to the kubeconfig secret. No public exploit is identified at time of analysis, but the attack requires only the ability to open a PR.