CVE-2026-44286
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
FastGPT before version 4.14.17 has an unauthenticated SSRF vulnerability. The fetchData function does not validate URLs against an internal blocklist, allowing requests to internal/private addresses.
Risk Assessment
Risk of internal network scanning, access to internal services, and potential attack escalation.
Recommendation
Update FastGPT to version 4.14.17 or later; restrict network access to FastGPT instances.
Original NVD description (English source)
FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privileges) to send arbitrary HTTP requests to internal/private network addresses. The fetchData function in the lafModule workflow node uses axios to fetch user-controlled URLs without validating them against the application's internal network blocklist guard (isInternalAddress), bypassing SSRF protections. This issue has been patched in version 4.14.17.