EUVD-2026-44753Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Network vector confirmed; AC:H because victim app ID must be discovered; PR:L as authentication is mandatory; I:H for arbitrary cross-tenant HTTP tool execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.
AnalysisAI
Authorization bypass in FastGPT's workflow engine allows any authenticated platform user to invoke another user's private HTTP toolsets by crafting a workflow node ID in the form http-<victim_toolset_app_id>/<tool_name>. Affected versions span 4.14.17 through pre-4.15.0-beta5; the normal toolset access routes enforce ownership, but the workflow save path and the /api/v2/chat/completions runtime endpoint omit the same check, enabling cross-tenant tool execution. No public exploit code or CISA KEV listing exists at time of analysis; the AC:H vector reflects that exploitation requires prior knowledge of a victim's toolset app ID.
Technical ContextAI
FastGPT (CPE: cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:*) is an open-source knowledge-based AI application platform that lets users compose LLM workflows referencing private HTTP toolsets. The root cause is CWE-863 (Incorrect Authorization): the platform enforces an authorization gate on standard toolset-listing and toolset-access routes, but that gate was never applied consistently to the workflow persistence layer or to the /api/v2/chat/completions inference endpoint. Because HTTP toolsets are referenced by a structured identifier (http-<app_id>/<tool_name>) rather than a secret token, a user who learns or guesses a victim's toolset app ID can persist a reference to that toolset in their own workflow. When the workflow runs, the runtime resolves the reference and executes the victim-owned HTTP tool without checking ownership, violating the intended authorization boundary between tenants.
RemediationAI
The vendor-released fix is version 4.15.0-beta5, which adds a secondary authorization check during workflow execution (the release notes note 'system tool runs, re-apply secondary permission verification'). Operators should update the fastgpt-app container to image tag v4.15.0-beta5, the fastgpt-pro container to v4.15.0-beta5, and fastgpt-plugin to v1.0.0-beta5, following the upgrade guide at https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5. If immediate upgrade is not feasible, a compensating control is to restrict the FastGPT deployment to a single-tenant or fully trusted user base, eliminating the cross-user threat surface; note this does not fix the underlying code flaw and is not suitable for shared or SaaS deployments. There is no documented configuration flag to disable HTTP toolset workflow references without restricting workflow functionality more broadly. Reference the security advisory at https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch for further vendor guidance.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-ima
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today