Product by Labring

    FastGPT

    33 known vulnerabilities in FastGPT (Labring), 0 of them actively exploited (CISA KEV).

    Key figures

    33

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in FastGPT (Labring)
    CriticalCVE-2026-42302

    Labring FastGPT: Missing Authentication for Critical Function

    		9.8
    CriticalCVE-2026-40351

    FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

    also in 1 other product

    		9.8
    CriticalCVE-2026-68929

    FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

    		—
    HighCVE-2026-55418

    Labring FastGPT: Authorization Bypass Through User-Controlled Key

    		8.6
    CriticalCVE-2026-34162

    FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft

    also in 1 other product

    		10.0
    HighCVE-2026-61684

    Labring FastGPT: Use of Hard-coded Credentials

    		—
    HighCVE-2026-40352

    FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover

    also in 1 other product

    		8.8
    CriticalCVE-2026-50562

    FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows

    		—
    CriticalCVE-2026-33075

    Labring FastGPT: Download of Code Without Integrity Check

    also in 1 other product

    		8.8
    HighCVE-2026-54607

    Labring FastGPT: Server-Side Request Forgery (SSRF)

    		7.7
    HighCVE-2026-61644

    Labring FastGPT: Incorrect Authorization

    		7.7
    MediumCVE-2026-84301

    FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

    		6.3
    HighCVE-2026-54602

    FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord

    		—
    HighCVE-2026-40252

    Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT

    also in 1 other product

    		8.1
    MediumCVE-2026-61646

    FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects

    		—
    HighCVE-2026-44285

    FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API

    		7.7
    HighCVE-2026-34163

    Server-Side Request Forgery via MCP Tools Endpoint in FastGPT

    also in 1 other product

    		7.7
    HighCVE-2026-42345

    Labring FastGPT: Server-Side Request Forgery (SSRF)

    		7.7
    MediumCVE-2026-54601

    Labring FastGPT: Improperly Controlled Modification of Dynamically-Determined Object Attributes

    		6.3
    CriticalCVE-2025-49131

    FastGPT Sandbox Vulnerable to Sandbox Bypass

    also in 1 other product

    		6.3
    MediumCVE-2026-26003

    FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack

    also in 1 other product

    		5.4
    MediumCVE-2026-42343

    FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion

    		—
    MediumCVE-2026-44287

    FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable

    		6.3
    MediumCVE-2026-32128

    FastGPT Python Sandbox Bypass of File-Write Restriction

    also in 1 other product

    		6.3
    MediumCVE-2026-61643

    FastGPT: workflow runtime can execute another user's private HTTP toolset

    		5.9

    All vulnerabilities in search

    All products by Labring