CVE-2026-26075: Cross-Site Request Forgery (CSRF) in FastGPT

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-12 · updated 2026-06-17
Weakness: CWE-352

Description

FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc. need to initiate data acquisition requests from the server, there are certain security issues. In addition to implementing internal network isolation in the deployment environment, this optimization has added stricter internal network address detection. This vulnerability is fixed in 4.14.7.

Affected products

labring FastGPT: before 4.14.7 — fixed in 4.14.7

How to fix

Upgrade to a fixed version: labring FastGPT 4.14.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-26075 or the next vulnerability affects your stack