Vendor

    Labring

    37 known vulnerabilities in products by Labring, 0 of them actively exploited (CISA KEV).

    Key figures

    37

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    10

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Labring
    CriticalCVE-2026-42302

    Labring FastGPT: Missing Authentication for Critical Function

    		9.8
    CriticalCVE-2026-40351

    FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

    also in 1 other product

    		9.8
    CriticalCVE-2026-68929

    FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

    		—
    HighCVE-2026-55418

    Labring FastGPT: Authorization Bypass Through User-Controlled Key

    		8.6
    CriticalCVE-2023-50253

    laf logs leak

    		9.7
    CriticalCVE-2026-34162

    FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft

    also in 1 other product

    		10.0
    CriticalCVE-2023-33190

    Improperly configured permissions in Sealos

    also in 1 other product

    		10.0
    CriticalCVE-2023-48225

    Laf env causes sensitive information disclosure

    		8.9
    HighCVE-2026-61684

    Labring FastGPT: Use of Hard-coded Credentials

    		—
    HighCVE-2026-40352

    FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover

    also in 1 other product

    		8.8
    CriticalCVE-2026-50562

    FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows

    		—
    CriticalCVE-2026-33075

    Labring FastGPT: Download of Code Without Integrity Check

    also in 1 other product

    		8.8
    HighCVE-2026-54607

    Labring FastGPT: Server-Side Request Forgery (SSRF)

    		7.7
    HighCVE-2026-61644

    Labring FastGPT: Incorrect Authorization

    		7.7
    MediumCVE-2026-84301

    FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

    		6.3
    HighCVE-2026-54602

    FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord

    		—
    HighCVE-2026-40252

    Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT

    also in 1 other product

    		8.1
    MediumCVE-2026-61646

    FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects

    		—
    HighCVE-2026-44285

    FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API

    		7.7
    HighCVE-2026-34163

    Server-Side Request Forgery via MCP Tools Endpoint in FastGPT

    also in 1 other product

    		7.7
    HighCVE-2026-42345

    Labring FastGPT: Server-Side Request Forgery (SSRF)

    		7.7
    HighCVE-2023-36815

    Sealos billing system permission control defect

    also in 1 other product

    		7.3
    MediumCVE-2026-54601

    Labring FastGPT: Improperly Controlled Modification of Dynamically-Determined Object Attributes

    		6.3
    CriticalCVE-2025-49131

    FastGPT Sandbox Vulnerable to Sandbox Bypass

    also in 1 other product

    		6.3
    MediumCVE-2026-26003

    FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack

    also in 1 other product

    		5.4

    All vulnerabilities in search

    Products

    Products by Labring
    FastGPT330