Vulnerability Description
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team's prompts, retrieved RAG chunks, and completions if the requestId is known. This issue is fixed in version 4.15.0.
Related Weaknesses (CWE)
References
- https://github.com/labring/FastGPT/commit/60c62b7af8269c826885b541bb56e6e5c424c1
- https://github.com/labring/FastGPT/security/advisories/GHSA-6vx6-f72r-74cg
FAQ
What is CVE-2026-54602?
CVE-2026-54602 is a documented vulnerability. FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without te...
How severe is CVE-2026-54602?
CVSS scoring is not yet available for CVE-2026-54602. Check NVD for updates.
Is there a patch for CVE-2026-54602?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.