10
CVEs
2
Critical
5
High
0
KEV
0
PoC
3
Unpatched C/H
70.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
5
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-68929 | Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker take over or disable a victim team's WeChat (iLink) bot binding. The WeChat share-channel endpoints authorize on the public shareId alone with no identity or team-ownership check, so an attacker who reads a shareId from any shared chat URL can wipe the stored WeChat token (offlining the bot) or bind the app to their own bot to siphon the team's private responses. No public exploit identified at time of analysis, but the flaw is trivially triggerable and fixed in version 4.15.2. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-50562 | GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request to smuggle attacker-controlled Docker images into privileged CI/CD pipelines. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted PR code in the preview-docs-build and preview-fastgpt-build workflows are consumed by privileged workflow_run jobs, letting a malicious image be pushed to GHCR and, for documentation previews, deployed to a Kubernetes cluster using the secrets.KUBE_CONFIG_CN credential. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is trivially reachable by any contributor. | CRITICAL | 9.3 | 0.2% | 46 |
No patch
|
| CVE-2026-61684 | Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugin reverse-call endpoints, because /api/invoke/* trusts tokens signed with INVOKE_TOKEN_SECRET whose default value is the literal string 'token' and which official deployment templates never set. By self-signing an HS256 JWT, an attacker can call /api/invoke/userInfo to read cross-tenant user PII via arbitrary tmbId values, or /api/invoke/fileUpload to write attacker-controlled content into chat files. No public exploit identified at time of analysis and not listed in CISA KEV, but the trivial exploitation and hardcoded-secret root cause make this high priority for self-hosted deployments. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-55418 | Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by supplying that team's S3 object key to the chat-file presign or dataset preview endpoints. The handlers authorize an unrelated resource but then sign or read the S3 object using a request-supplied key without verifying tenant ownership, so global bucket keys become an IDOR primitive. No public exploit code has been identified at time of analysis, though the upstream fix (PR #7104 / commit decb6d2) reveals the exact vulnerable code path. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2026-54607 | Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI schema importer to reach internal-only services and cloud instance metadata. Because the importer only validates the top-level URL and then hands the document to SwaggerParser.bundle, whose $ref resolver fetches remote references without FastGPT's internal-address guard, fetched content is returned inline to the caller. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the vendor advisory (GHSA-72hf-5382-2mq9) confirms the flaw and its fix. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-61644 | Cross-tenant data disclosure in FastGPT 4.14.17 through 4.15.0-beta5 lets a low-privileged tenant user read another tenant's dataset content via the POST /api/core/chat/record/getCollectionQuote endpoint. The endpoint validates the caller's chat and collection context but fails to bind the initialId center-node lookup to that authorized context, so an attacker supplying a foreign dataset data id as initialId (while using their own valid appId, chatId, chatItemDataId, and collectionId) receives the victim tenant's dataset quote or full-text content. This is an authenticated (PR:L) authorization flaw with no public exploit identified at time of analysis and no CISA KEV listing; EPSS data was not provided. | HIGH | 7.7 | 0.2% | 38 |
|
| CVE-2026-54602 | Broken object-level authorization in FastGPT before 4.15.0 lets any authenticated user retrieve another team's LLM interaction traces via GET /api/core/ai/record/getRecord. The endpoint verifies the caller is logged in but fetches records solely by requestId without checking team ownership, exposing cross-tenant prompts, retrieved RAG chunks, and model completions to any user who can guess or obtain a valid requestId. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but exploitation requires only a low-privilege account and knowledge of a target requestId. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-54601 | Cross-tenant authorization bypass in FastGPT (versions 4.14.17 through pre-4.15.0-beta4) permits an authenticated tenant user to inject a foreign tenant's datasetId via the POST /api/core/dataset/collection/create/reTrainingCollection endpoint, corrupting ownership anchors in persisted dataset objects. Downstream dataset, collection, and training endpoints then derive authorization decisions from these poisoned records, granting the attacker cross-tenant read, update, and delete access to another tenant's data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the vendor released version 4.15.0-beta4 as the confirmed fix. | MEDIUM | 6.3 | 0.2% | 32 |
|
| CVE-2026-61646 | SSRF guard bypass in FastGPT prior to 4.15.0-beta5 enables authenticated workflow users to reach cloud metadata endpoints, loopback interfaces, and internal network services that the guard would otherwise block on direct request. The HTTP request workflow node submits the initial URL to the SSRF guard for validation, but then hands the request to axios, which follows HTTP redirects by default without re-triggering the guard - allowing an attacker-controlled redirect server to pivot the request to any internal target. No public exploit code has been identified at time of analysis, but the technique is well-understood, low-complexity once authenticated, and particularly severe in cloud-hosted deployments where IMDSv1 metadata endpoints expose IAM credentials. | MEDIUM | 6.3 | 0.2% | 32 |
|
| CVE-2026-61643 | Authorization bypass in FastGPT's workflow engine allows any authenticated platform user to invoke another user's private HTTP toolsets by crafting a workflow node ID in the form http-<victim_toolset_app_id>/<tool_name>. Affected versions span 4.14.17 through pre-4.15.0-beta5; the normal toolset access routes enforce ownership, but the workflow save path and the /api/v2/chat/completions runtime endpoint omit the same check, enabling cross-tenant tool execution. No public exploit code or CISA KEV listing exists at time of analysis; the AC:H vector reflects that exploitation requires prior knowledge of a victim's toolset app ID. | MEDIUM | 5.9 | 0.2% | 30 |
|