CVE-2026-26075— Cross-Site Request Forgery (CSRF) in FastGPT
Quick assessment
Affected
labring FastGPT
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FastGPT是labring开源的一款基于大语言模型的开源知识库问答系统。 FastGPT 4.14.7之前版本存在跨站请求伪造漏洞，该漏洞源于网页采集节点和HTTP节点需要从服务器发起数据采集请求，存在安全风险。
Possible ATT&CK Techniques 1 AI
T1046 · Network Service Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-26075
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site Request Forgery (CSRF) in FastGPT
Source: CVE Program / CVE List V5
Vulnerability Description
FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc. need to initiate data acquisition requests from the server, there are certain security issues. In addition to implementing internal network isolation in the deployment environment, this optimization has added stricter internal network address detection. This vulnerability is fixed in 4.14.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
FastGPT 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FastGPT是labring开源的一款基于大语言模型的开源知识库问答系统。 FastGPT 4.14.7之前版本存在跨站请求伪造漏洞，该漏洞源于网页采集节点和HTTP节点需要从服务器发起数据采集请求，存在安全风险。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-26075
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-26075
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: FastGPT
-
CVE-2026-84301
FastGPT safe axios SSRF guard still allows DNS rebinding TOC -
CVE-2026-68929
FastGPT: Unauthenticated WeChat channel hijack and denial of -
CVE-2026-61643
FastGPT: workflow runtime can execute another user's private -
CVE-2026-50562
FastGPT: Untrusted PR artifacts are pushed and deployed by p -
CVE-2026-61646
FastGPT: Shared axios SSRF guard validates only the initial
Same vendor: labring
-
CVE-2026-84301
FastGPT safe axios SSRF guard still allows DNS rebinding TOC -
CVE-2026-68929
FastGPT: Unauthenticated WeChat channel hijack and denial of -
CVE-2026-61643
FastGPT: workflow runtime can execute another user's private -
CVE-2026-50562
FastGPT: Untrusted PR artifacts are pushed and deployed by p -
CVE-2026-61646
FastGPT: Shared axios SSRF guard validates only the initial
Same weakness: CWE-352
-
CVE-2026-104407
WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Si -
CVE-2026-105292
Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callba -
CVE-2026-39718
WordPress Wallstreet theme <= 2.8.6 - Cross Site Request For -
CVE-2026-104452
YesWiki before 4.6.7 CSRF Attachment Deletion via filemanage -
CVE-2026-104453
YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
V. Comments for CVE-2026-26075
No comments yet