Security Advisory

CVE-2026-44286

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-08 22:17:17

Last updated 2026-05-11 14:22:32

Assigner GitHub_M

CVSS score 2.3

State PUBLISHED

Description

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privileges) to send arbitrary HTTP requests to internal/private network addresses. The fetchData function in the lafModule workflow node uses axios to fetch user-controlled URLs without validating them against the application's internal network blocklist guard (isInternalAddress), bypassing SSRF protections. This issue has been patched in version 4.14.17.

← Browse all CVEs View on cve.org ↗