CVE-2026-26075: fallo de gravedad media en labring FastGPT
Cross-Site Request Forgery (CSRF) in FastGPT
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.1%
FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc. need to initiate data acquisition requests from the server, there are certain security issues. In addition to implementing internal network isolation in the deployment environment, this optimization has added stricter internal network address detection. This vulnerability is fixed in 4.14.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
labring · FastGPTCVEs relacionadas — labring FastGPT
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-42302CRITICALFastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandboxEPSS 0.7%CVE-2026-40351CRITICALFastGPT: NoSQL Injection in loginByPassword leads to Authentication BypassEPSS 0.6%CVE-2025-49131MEDIUMFastGPT Sandbox Vulnerable to Sandbox BypassEPSS 0.5%CVE-2026-55418HIGHFastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)EPSS 0.5%CVE-2026-68929CRITICALFastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorizationEPSS 0.4%CVE-2026-34162CRITICALFastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key TheftEPSS 0.4%