FastGPT EUVD-2026-44676

Exploitation requires a FastGPT 4.15.0-beta4 deployment where INVOKE_TOKEN_SECRET is left at its default value 'token' (or otherwise unset) - the out-of-the-box state for official Helm and docker-compose templates, which never populated this variable. The attacker needs only network reachability to the /api/invoke/* endpoints; no account, credentials, or user interaction is needed (CVSS PR:N/UI:N). Exploitation is LIMITED to instances that did not manually configure a strong INVOKE_TOKEN_SECRET: any operator who set a random secret before upgrading was never exploitable, and after upgrading to 4.15.0-beta5 the variable is mandatory and validated. Impact scope is bounded to what the invoke endpoints expose - cross-tenant user PII read via tmbId and content writes into chat files - not full server compromise.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N, score 8.8) indicates fully remote, low-complexity, unauthenticated exploitation with high confidentiality impact and low integrity impact - consistent with the description, since forging a JWT from a known default secret requires no privileges and no user interaction. EPSS was not provided, and the CVE is not in CISA KEV, so there is no confirmed active exploitation; there is also no referenced POC, so exploitation is currently theoretical but technically trivial. The signals are internally consistent (no conflict between vector and description). This is a genuine high priority rather than an inflated high-CVSS issue: the prerequisite (secret left at default) was the out-of-the-box state for official templates, so a large share of self-hosted instances were likely exploitable, and PII disclosure across tenants is a direct, automatable impact. The main mitigating factor is that operators who manually set a strong INVOKE_TOKEN_SECRET were never vulnerable.

An attacker who can reach a self-hosted FastGPT instance on the network crafts an HS256 JWT signed with the known default secret 'token' and sends it to /api/invoke/userInfo, iterating tmbId values to harvest other tenants' user PII. Using the same forged token against /api/invoke/fileUpload, they write attacker-controlled content into chat files. No authentication, credentials, or user interaction are required, and no POC is publicly referenced yet.