CVE-2026-26075
📋 TL;DR
FastGPT versions before 4.14.7 have insufficient internal network address validation in web page acquisition and HTTP nodes, allowing potential cross-site request forgery (CSRF) attacks. This affects organizations using FastGPT for AI agent building where these nodes can be manipulated to access internal network resources. The vulnerability requires attackers to trick authenticated users into performing unintended actions.
💻 Affected Systems
- FastGPT
📦 What is this software?
Fastgpt by Fastgpt
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exploit CSRF to make FastGPT nodes access internal network services, potentially leading to data exfiltration, internal service compromise, or lateral movement within the network.
Likely Case
Attackers could manipulate FastGPT to make unauthorized requests to internal APIs or services, potentially accessing sensitive data or performing actions with the permissions of the compromised FastGPT instance.
If Mitigated
With proper network segmentation and CSRF protections, the impact is limited to the specific FastGPT instance's permissions and network access.
🎯 Exploit Status
Exploitation requires CSRF conditions - attacker must trick authenticated user into interacting with malicious content. No public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.14.7
Vendor Advisory: https://github.com/labring/FastGPT/security/advisories/GHSA-g345-7pqp-c395
Restart Required: No
Instructions:
1. Backup your FastGPT configuration and data. 2. Update FastGPT to version 4.14.7 or later using your deployment method (Docker, Kubernetes, etc.). 3. Verify the update completed successfully. 4. Test critical functionality.
🔧 Temporary Workarounds
Implement Network Segmentation
allIsolate FastGPT instances from sensitive internal networks using firewalls or network policies.
Enable CSRF Protections
allImplement additional CSRF tokens and same-origin policies in web applications interacting with FastGPT.
🧯 If You Can't Patch
- Implement strict network segmentation to limit FastGPT's access to only necessary internal resources
- Disable or restrict web page acquisition and HTTP nodes in FastGPT configuration if not required
🔍 How to Verify
Check if Vulnerable:
Check FastGPT version via web interface or configuration files. If version is below 4.14.7 and using data acquisition nodes, the system is vulnerable.Check Version:
docker exec fastgpt_container cat /app/package.json | grep version (for Docker deployments) or check FastGPT web interface settingsVerify Fix Applied:
Confirm FastGPT version is 4.14.7 or higher. Test that web page acquisition and HTTP nodes properly validate internal network addresses.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests from FastGPT to internal network addresses
- Failed internal network access attempts from FastGPT nodes
Network Indicators:
- Unexpected outbound connections from FastGPT to internal services
- HTTP requests to internal IPs from FastGPT server
SIEM Query:
source="fastgpt" AND (dest_ip=10.* OR dest_ip=172.16.* OR dest_ip=192.168.*) AND action="http_request"