Which versions of FastGPT are affected by CVE-2026-50562?

FastGPT deployments using the affected CI/CD pipelines are vulnerable to code injection attacks initiated through pull requests.

How to fix or mitigate CVE-2026-50562?

Within 24 hours, restrict pull request creation to verified contributors and immediately audit your container registry (GHCR) for any suspicious or unauthorized images pushed since deploying FastGPT; also review deployment logs for any unauthorized Kubernetes cluster access. Within 7 days, implement mandatory review and approval gates before any pull-request-generated artifacts are consumed by privileged CI/CD jobs, disable the preview-docs-build and preview-fastgpt-build workflows from being triggered by pull requests from external contributors, rotate your Kubernetes credential (secrets.KUBE_CONFIG_CN) immediately, and replace it with a read-only or minimal-privilege service account. Within 30 days, monitor the labring/FastGPT repository for patches addressing commits prior to and including 22ebfacbb43311e9b73294040ae0eb87390c6bba, upgrade to the patched version when available, and implement additional controls including container image signing verification, network policies restricting image pulls, and RBAC restrictions on deployment service accounts.

FastGPT CVE-2026-50562

Q: What is the CVSS score of CVE-2026-50562?

CVE-2026-50562 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44749 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-07-15 GitHub_M

Docker Information Disclosure Fastgpt

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Anyone can open a PR so PR:N/UI:N; scope changes (S:C) as the CI flaw compromises GHCR and the K8s cluster; C:H from KUBE_CONFIG_CN exposure, I:H from malicious image push, A:L from possible deploy disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:L

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 17:46 vuln.today

CVE Published

Jul 15, 2026 - 16:55 cve.org

CRITICAL 9.3

DescriptionCVE.org

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged workflow_run jobs in .github/workflows/preview-docs-push.yml and .github/workflows/preview-fastgpt-push.yml, allowing attacker-controlled Docker images from the document/ tree or FastGPT build context to be pushed to GHCR and, for documentation previews, deployed with secrets.KUBE_CONFIG_CN.

Articles & Coverage 1

News Critical Artifact-Poisoning via Docker Image Smuggling in FastGPT - CVE-2026-50562 Jul 16, 2026

AnalysisAI

GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request to smuggle attacker-controlled Docker images into privileged CI/CD pipelines. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted PR code in the preview-docs-build and preview-fastgpt-build workflows are consumed by privileged workflow_run jobs, letting a malicious image be pushed to GHCR and, for documentation previews, deployed to a Kubernetes cluster using the secrets.KUBE_CONFIG_CN credential. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is trivially reachable by any contributor.

Technical ContextAI

The root cause is CWE-266 (Incorrect Privilege Assignment) manifested as the classic GitHub Actions 'pwn request' / artifact-poisoning pattern. The build workflows (.github/workflows/preview-docs-build.yml and preview-fastgpt-build.yml) run in the low-privilege pull_request context and produce build artifacts from untrusted fork code (the document/ tree and the FastGPT build context). The push workflows (preview-docs-push.yml and preview-fastgpt-push.yml) are triggered by the workflow_run event, which executes in the repository's trusted context with access to write permissions and secrets. Because the privileged workflow_run job downloads and trusts an artifact produced by attacker code, a fork PR can substitute a malicious Docker image that is then pushed to the GitHub Container Registry (GHCR) and, for the docs pipeline, deployed to the CN Kubernetes cluster via secrets.KUBE_CONFIG_CN. The affected product per CPE is cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:*.

RemediationAI

Update to a FastGPT commit that includes the corrected workflows as described in advisory GHSA-rvgc-2c29-g876 (https://github.com/labring/FastGPT/security/advisories/GHSA-rvgc-2c29-g876); an exact patched release tag is not specified in the available data, so the fix should be pulled from the commit that supersedes 22ebfacbb43311e9b73294040ae0eb87390c6bba. Concrete hardening steps that address the pwn-request pattern: stop passing repository secrets (especially KUBE_CONFIG_CN) to any job that consumes artifacts built from fork code; require manual approval for workflows triggered by external pull requests via GitHub's 'require approval for all outside collaborators' setting; validate and pin artifact provenance before the privileged workflow_run job downloads it, or rebuild the image inside the trusted job rather than trusting the PR-produced artifact; scope the GHCR/registry token and KUBE_CONFIG_CN to the minimum needed and rotate KUBE_CONFIG_CN if there is any suspicion it was exposed. The trade-off of requiring PR approval is added maintainer friction on legitimate contributions, and rebuilding images in-trust increases CI runtime.