Vulnerability Description
FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privileges) to send arbitrary HTTP requests to internal/private network addresses. The fetchData function in the lafModule workflow node uses axios to fetch user-controlled URLs without validating them against the application's internal network blocklist guard (isInternalAddress), bypassing SSRF protections. This issue has been patched in version 4.14.17.
Related Weaknesses (CWE)
References
- https://github.com/labring/FastGPT/releases/tag/v4.14.17
- https://github.com/labring/FastGPT/security/advisories/GHSA-xpx6-xcpf-76qg
- https://github.com/labring/FastGPT/security/advisories/GHSA-xpx6-xcpf-76qg
FAQ
What is CVE-2026-44286?
CVE-2026-44286 is a documented vulnerability. FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privil...
How severe is CVE-2026-44286?
CVSS scoring is not yet available for CVE-2026-44286. Check NVD for updates.
Is there a patch for CVE-2026-44286?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.