Which versions of FastGPT are affected by CVE-2026-61684?

FastGPT 4.15.0-beta4 self-hosted deployments are vulnerable to unauthenticated authentication bypass (CVE-2026-61684, CVSS 8.8) that allows attackers to forge JWTs and access internal endpoints,…

How to fix or mitigate CVE-2026-61684?

Within 24 hours, identify all FastGPT 4.15.0-beta4 deployments and verify whether INVOKE_TOKEN_SECRET environment variable has been set to a value other than the default 'token'-affected instances are actively exploitable despite no public exploit identified at time of analysis. Within 7 days, immediately change INVOKE_TOKEN_SECRET to a cryptographically random 32+ character value on all vulnerable instances, restrict /api/invoke/* endpoints to internal-only network access, and review logs for any JWT-signed requests to userInfo and fileUpload endpoints dating back 90 days. Within 30 days, monitor FastGPT release channels for a patched version, conduct a security assessment of potentially accessed data, and execute the upgrade when a patch becomes available.

FastGPT CVE-2026-61684

Q: What is the CVSS score of CVE-2026-61684?

CVE-2026-61684 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44676 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-07-15 GitHub_M

Authentication Bypass Fastgpt Labring

8.8

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Remote, unauthenticated, low-complexity JWT forgery via a known default secret (AV:N/AC:L/PR:N/UI:N); high confidentiality from cross-tenant PII read, low integrity from chat-file writes, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 15:19 vuln.today

Analysis Generated

Jul 15, 2026 - 15:19 vuln.today

CVE Published

Jul 15, 2026 - 14:28 cve.org

HIGH 8.8

DescriptionCVE.org

FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints under /api/invoke/* authenticate only by verifying a JWT signed with INVOKE_TOKEN_SECRET, which defaults to the constant string token and was not set in official deployment templates. An unauthenticated attacker can self-sign an HS256 JWT and reach /api/invoke/userInfo to disclose cross-tenant user PII by attacker-supplied tmbId values, or /api/invoke/fileUpload to write attacker-controlled content into chat files. This issue is fixed in version 4.15.0-beta5.

AnalysisAI

Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugin reverse-call endpoints, because /api/invoke/* trusts tokens signed with INVOKE_TOKEN_SECRET whose default value is the literal string 'token' and which official deployment templates never set. By self-signing an HS256 JWT, an attacker can call /api/invoke/userInfo to read cross-tenant user PII via arbitrary tmbId values, or /api/invoke/fileUpload to write attacker-controlled content into chat files. No public exploit identified at time of analysis and not listed in CISA KEV, but the trivial exploitation and hardcoded-secret root cause make this high priority for self-hosted deployments.

Technical ContextAI

FastGPT is a self-hosted, knowledge-base AI application platform (vendor labring, CPE cpe:2.3:a:labring:fastgpt). Its plugin system uses 'reverse-call' (Invoke) endpoints under /api/invoke/* that let plugin/worker services call back into the main app. Authentication on these endpoints relies solely on verifying an HS256 JWT signed with the INVOKE_TOKEN_SECRET environment variable. The root cause is CWE-798 (Use of Hard-coded Credentials): the secret defaulted to the constant string 'token' and was omitted from Helm charts, docker-compose templates, and documentation, so any deployment that did not manually set it used a globally known signing key. Because HS256 is symmetric, knowledge of the key allows anyone to mint valid tokens. The fix (PR #7170) makes INVOKE_TOKEN_SECRET a required runtime variable of at least 32 characters, adds it to all deployment templates and env documentation, and enforces it alongside FILE_TOKEN_KEY and AES256_SECRET_KEY.

RemediationAI

Vendor-released patch: 4.15.0-beta5 - upgrade FastGPT to this version (release https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5) and review GHSA-w732-rq8c-chc8. As the essential configuration step (and an immediate mitigation for those who cannot upgrade at once), set INVOKE_TOKEN_SECRET to a strong random value of at least 32 characters and ensure the same value is configured on both the main app and the plugin/worker service so reverse calls still function; leaving it at the default 'token' or unset is what enables the bypass. Update your deployment source (Helm secret-env.yaml, docker-compose.template.yml, or 4-15/41501 upgrade env) accordingly, alongside FILE_TOKEN_KEY and AES256_SECRET_KEY. As an additional compensating control until patched, restrict network exposure of the /api/invoke/* endpoints to trusted internal service IPs via reverse proxy or firewall rules - with the trade-off that legitimate reverse calls from external plugin runners must be explicitly allowlisted or they will break.