CVE-2026-54607

Published: Jul 7, 2026Modified: Jul 8, 2026Deferred

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.1 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT's internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata. This issue is fixed in version 4.15.0-beta4.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://github.com/labring/FastGPT/commit/1d7b8768aecd53ae59372fd68b10af0e80722c79

Source: security-advisories@github.com

https://github.com/labring/FastGPT/pull/7073

Source: security-advisories@github.com

https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta4

Source: security-advisories@github.com

https://github.com/labring/FastGPT/security/advisories/GHSA-72hf-5382-2mq9

Source: security-advisories@github.com

https://github.com/labring/FastGPT/security/advisories/GHSA-72hf-5382-2mq9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.