Login Request a demo
FA
Product
FastGPT
by labring · last CVE Sep 22, 2026
33
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities33In the news0Timeline
Severity mix
Critical 6High 11Medium 15Low 1
Severity
All severities33Critical6High11Medium15Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add FastGPT to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-27600
6.5
0%
Mar 6
FastGPT SSRF
Affected: < 4.9.0
CVE-2026-84301
6.3
0%
Sep 22
FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
Affected: < 4.15.2
CVE-2026-61646
6.3
0%
Jul 15
FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects
Affected: < 4.15.0-beta5
CVE-2026-54601
6.3
0%
Jul 7
FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion
Affected: >= 4.14.17, < 4.15.0-beta4
CVE-2026-44287
6.3
0%
May 29
FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable
Affected: < 4.15.0-beta1
CVE-2026-44284
6.3
0%
May 8
FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution
Affected: < 4.14.17
CVE-2026-42344
6.3
0%
May 8
FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints
Affected: <= 4.14.11
CVE-2026-42343
6.3
0%
May 8
FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion
Affected: <= 4.14.13
CVE-2026-32128
6.3
0%
Mar 11
FastGPT Python Sandbox Bypass of File-Write Restriction
Affected: <= 4.14.7
CVE-2025-52552
6.1
0%
Jun 21
FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS
Affected: < 4.9.12
CVE-2026-61643
5.9
0%
Jul 15
FastGPT: workflow runtime can execute another user's private HTTP toolset
Affected: >= 4.14.17, < 4.15.0-beta5
CVE-2026-26075
5.4
0%
Feb 12
Cross-Site Request Forgery (CSRF) in FastGPT
Affected: < 4.14.7
CVE-2026-26003
5.4
0%
Feb 10
FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack
Affected: >= 4.14.0, < 4.14.5-fix
CVE-2026-40100
5.3
0%
Apr 10
FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default
Affected: < 4.14.10.3
CVE-2025-62612
5.3
0%
Oct 22
FastGPT File Reading Node SSRF Vulnerability
Affected: < 4.11.1
Showing 15