Labring Fastgpt vulnerabilities

• labring fastgpt FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests CVE-2026-84301 6.3 MediumSeptember 22, 2026
• labring fastgpt FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization CVE-2026-68929 9.3 CriticalAugust 27, 2026
• labring fastgpt FastGPT: workflow runtime can execute another user's private HTTP toolset CVE-2026-61643 5.9 MediumJuly 15, 2026
• labring fastgpt FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows CVE-2026-50562 9.3 CriticalJuly 15, 2026
• labring fastgpt FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects CVE-2026-61646 6.3 MediumJuly 15, 2026
• labring fastgpt FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup CVE-2026-61644 7.7 HighJuly 15, 2026
• labring fastgpt FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token') CVE-2026-61684 8.8 HighJuly 15, 2026
• labring fastgpt FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord CVE-2026-54602 7.1 HighJuly 7, 2026
• labring fastgpt FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard) CVE-2026-54607 7.7 HighJuly 7, 2026
• labring fastgpt FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure) CVE-2026-55418 8.6 HighJuly 7, 2026
• labring fastgpt FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion CVE-2026-54601 6.3 MediumJuly 7, 2026
• labring fastgpt FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable CVE-2026-44287 6.3 MediumMay 29, 2026
• labring fastgpt FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API CVE-2026-44285 7.7 HighMay 29, 2026
• labring fastgpt FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation CVE-2026-44286 2.3 LowMay 8, 2026
• labring fastgpt FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution CVE-2026-44284 6.3 MediumMay 8, 2026
• labring fastgpt FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot CVE-2026-42345 7.7 HighMay 8, 2026
• labring fastgpt FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints CVE-2026-42344 6.3 MediumMay 8, 2026
• labring fastgpt FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion CVE-2026-42343 6.3 MediumMay 8, 2026
• labring fastgpt FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox CVE-2026-42302 9.8 CriticalMay 8, 2026
• fastgpt FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover CVE-2026-40352 8.8 HighApril 17, 2026
• fastgpt FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass CVE-2026-40351 9.8 CriticalApril 17, 2026
• fastgpt Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT CVE-2026-40252 5.3 MediumApril 10, 2026
• fastgpt FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default CVE-2026-40100 5.3 MediumApril 10, 2026
• fastgpt FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft CVE-2026-34162 10.0 CriticalMarch 31, 2026
• fastgpt Server-Side Request Forgery via MCP Tools Endpoint in FastGPT CVE-2026-34163 7.7 HighMarch 31, 2026
• fastgpt FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml CVE-2026-33075 Public exploit 9.4 CriticalMarch 20, 2026
• fastgpt FastGPT Python Sandbox Bypass of File-Write Restriction CVE-2026-32128 Public exploit 6.3 MediumMarch 11, 2026
• fastgpt Cross-Site Request Forgery (CSRF) in FastGPT CVE-2026-26075 6.9 MediumFebruary 12, 2026
• fastgpt FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack CVE-2026-26003 6.9 MediumFebruary 10, 2026
• fastgpt FastGPT File Reading Node SSRF Vulnerability CVE-2025-62612 6.9 MediumOctober 22, 2025
• fastgpt FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS CVE-2025-52552 5.5 MediumJune 21, 2025
• fastgpt FastGPT Sandbox Vulnerable to Sandbox Bypass CVE-2025-49131 Public exploit 6.3 MediumJune 9, 2025
• fastgpt FastGPT SSRF CVE-2025-27600 6.9 MediumMarch 6, 2025