CVE-2026-44286: Labring Fastgpt

Low severity, CVSS 2.3. EPSS: 0.4% chance of exploitation in the next 30 days.

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privileges) to send arbitrary HTTP requests to internal/private network addresses. The fetchData function in the lafModule workflow node uses axios to fetch user-controlled URLs without validating them against the application's internal network blocklist guard (isInternalAddress), bypassing SSRF protections. This issue has been patched in version 4.14.17.

Affected products

• Labring Fastgpt: before 4.14.17 (fixed in 4.14.17)

Published 2026-05-08. Last modified 2026-07-24.